HTTP: Apache Tomcat NIO Connector Denial of Service
This signature detects attempts to exploit a known flaw in Apache Tomcat. The vulnerability is due to an infinite loop in NIO Connector when a client breaks the connection in the middle of reading the response for a request to a big file. An unauthenticated, remote attacker can exploit this vulnerability by sending HTTP requests for a large file and disconnecting from the server while reading the file. Successful exploitation could result in a denial of service condition.
Extended Description
org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
Affected Products
Apache tomcat
References
CVE: CVE-2012-4534
Short Name
HTTP:APACHE:APACHE-NIO-DOS
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Apache CVE-2012-4534 Connector Denial NIO Service Tomcat of
Release Date
08/11/2014
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3735
False Positive
Unknown
Vendors
Apache
CVSS Score
2.6