News
Vigil@nce - Apache Tomcat: denial of service via several parameters
February 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can send a query containing several parameters to Apache Tomcat, in order to overload the CPU.
Severity: 2/4
Creation date: 17/01/2012
IMPACTED PRODUCTS
Apache Tomcat
DESCRIPTION OF THE VULNERABILITY
An HTTP GET or POST query uses parameters like "para1=value¶2=value&...".
The org/apache/tomcat/util/http/Parameters.java file decodes these parameters. However, the algorithm used is not efficient. If the query contains numerous parameters, Tomcat consumes a lot a processor resources.
An attacker can therefore send a query containing several parameters to Apache Tomcat, in order to overload the CPU.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
