what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2013-0266-01

Posted Feb 19, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0266-01 - Apache Tomcat is a servlet container. It was found that sending a request without a session identifier to a protected resource could bypass the Cross-Site Request Forgery prevention filter. A remote attacker could use this flaw to perform CSRF attacks against applications that rely on the CSRF prevention filter and do not contain internal mitigation for CSRF. A flaw was found in the way Tomcat handled sendfile operations when using the HTTP NIO connector and HTTPS. A remote attacker could use this flaw to cause a denial of service. The HTTP NIO connector is used by default in JBoss Enterprise Web Server. The Apache Portable Runtime connector from the Tomcat Native library was not affected by this flaw.

tags | advisory, remote, web, denial of service, csrf

systems | linux, redhat

advisories | CVE-2012-2733, CVE-2012-4431, CVE-2012-4534, CVE-2012-5885, CVE-2012-5886, CVE-2012-5887

SHA-256 | 838e0b0453161e876d6ad39703ceea8e53d3dc5c7776541bd1681cd631c9061c

Download | Favorite | View

Related Files

No related files