CVE

Id
64233  
CVE No.
CVE-2013-4286  
Status
Candidate  
Description
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request"s length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
633577 64233 CVE-2013-4286 BUGTRAQ:20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
633578 64233 CVE-2013-4286 URL:http://www.securityfocus.com/archive/1/archive/1/534161/100/0/threaded  View
633579 64233 CVE-2013-4286 FULLDISC:20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
633580 64233 CVE-2013-4286 URL:http://seclists.org/fulldisclosure/2014/Dec/23  View
633581 64233 CVE-2013-4286 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1521829  View
633582 64233 CVE-2013-4286 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1521854  View
633583 64233 CVE-2013-4286 CONFIRM:http://svn.apache.org/viewvc?view=revision&revision=1552565  View
633584 64233 CVE-2013-4286 CONFIRM:http://tomcat.apache.org/security-6.html  View
633585 64233 CVE-2013-4286 CONFIRM:http://tomcat.apache.org/security-7.html  View
633586 64233 CVE-2013-4286 CONFIRM:http://tomcat.apache.org/security-8.html  View
633587 64233 CVE-2013-4286 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1069921  View
633588 64233 CVE-2013-4286 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21667883  View
633589 64233 CVE-2013-4286 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21675886  View
633590 64233 CVE-2013-4286 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21677147  View
633591 64233 CVE-2013-4286 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21678113  View
633592 64233 CVE-2013-4286 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21678231  View
633593 64233 CVE-2013-4286 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
633594 64233 CVE-2013-4286 CONFIRM:http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
633595 64233 CVE-2013-4286 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html  View
633596 64233 CVE-2013-4286 CONFIRM:http://advisories.mageia.org/MGASA-2014-0148.html  View
633597 64233 CVE-2013-4286 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html  View
633598 64233 CVE-2013-4286 CONFIRM:http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
633599 64233 CVE-2013-4286 CONFIRM:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013  View
633600 64233 CVE-2013-4286 DEBIAN:DSA-3530  View
633601 64233 CVE-2013-4286 URL:http://www.debian.org/security/2016/dsa-3530  View
633602 64233 CVE-2013-4286 HP:HPSBUX03150  View
633603 64233 CVE-2013-4286 URL:http://marc.info/?l=bugtraq&m=141390017113542&w=2  View
633604 64233 CVE-2013-4286 HP:HPSBOV03503  View
633605 64233 CVE-2013-4286 URL:http://marc.info/?l=bugtraq&m=144498216801440&w=2  View
633606 64233 CVE-2013-4286 MANDRIVA:MDVSA-2015:052  View
633607 64233 CVE-2013-4286 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2015:052  View
633608 64233 CVE-2013-4286 REDHAT:RHSA-2014:0343  View
633609 64233 CVE-2013-4286 URL:http://rhn.redhat.com/errata/RHSA-2014-0343.html  View
633610 64233 CVE-2013-4286 REDHAT:RHSA-2014:0344  View
633611 64233 CVE-2013-4286 URL:http://rhn.redhat.com/errata/RHSA-2014-0344.html  View
633612 64233 CVE-2013-4286 REDHAT:RHSA-2014:0345  View
633613 64233 CVE-2013-4286 URL:http://rhn.redhat.com/errata/RHSA-2014-0345.html  View
633614 64233 CVE-2013-4286 REDHAT:RHSA-2014:0686  View
633615 64233 CVE-2013-4286 URL:https://rhn.redhat.com/errata/RHSA-2014-0686.html  View
633616 64233 CVE-2013-4286 BID:65773  View
633617 64233 CVE-2013-4286 URL:http://www.securityfocus.com/bid/65773  View
633618 64233 CVE-2013-4286 SECUNIA:57675  View
633619 64233 CVE-2013-4286 URL:http://secunia.com/advisories/57675  View
633620 64233 CVE-2013-4286 SECUNIA:59036  View
633621 64233 CVE-2013-4286 URL:http://secunia.com/advisories/59036  View
633622 64233 CVE-2013-4286 SECUNIA:59722  View
633623 64233 CVE-2013-4286 URL:http://secunia.com/advisories/59722  View
633624 64233 CVE-2013-4286 SECUNIA:59724  View
633625 64233 CVE-2013-4286 URL:http://secunia.com/advisories/59724  View
633626 64233 CVE-2013-4286 SECUNIA:59733  View
633627 64233 CVE-2013-4286 URL:http://secunia.com/advisories/59733  View
633628 64233 CVE-2013-4286 SECUNIA:59873  View
633629 64233 CVE-2013-4286 URL:http://secunia.com/advisories/59873  View
633630 64233 CVE-2013-4286 SECUNIA:59675  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
22807 JVNDB-2013-004382 libvirt の virSecurityManagerSetProcessLabel 関数における権限を取得される脆弱性 libvirt の virSecurityManagerSetProcessLabel 関数には、ドメインが uid:gid ラベルを読む場合、グループメンバーシップを適切に設定しないため、権限を取得される脆弱性が存在します。 CVE-2013-4291 64233 6.9 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004382.html  View