CVE-2007-6286: Apache Tomcat Does Not Properly Handle Empty Requests
Summary
CVE-2007-6286: Apache Tomcat Does Not Properly Handle Empty Requests. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 5.5.11, <= 5.5.25
>= 6.0.0, <= 6.0.15
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a robust and scalable platform for hosting web applications. The vulnerability described in this report affects Apache Tomcat versions 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15 when the native APR connector is used. The native APR connector is a component that enables Tomcat to use the Apache Portable Runtime (APR) library for improved performance and scalability. This vulnerability specifically relates to the handling of empty requests to the SSL port.
Vulnerability Detail
The vulnerability allows remote attackers to trigger the handling of "a duplicate copy of one of the recent requests" by sending an empty request to the SSL port. This can be exploited by an attacker using netcat or similar tools. The impact of this vulnerability is that it can lead to the processing of duplicate requests, potentially causing unexpected behavior or resource exhaustion. It is important to note that this vulnerability only affects Tomcat instances using the native APR connector.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a possible workaround is to disable the native APR connector and use the pure Java connector instead. This can be achieved by modifying the Tomcat configuration file to use the 'org.apache.coyote.http11.Http11Protocol' connector instead of the 'org.apache.coyote.http11.Http11AprProtocol' connector. However, it is important to note that this workaround may impact performance and scalability.
Conclusion
In conclusion, the vulnerability in Apache Tomcat described in this report can be exploited by sending an empty request to the SSL port, potentially leading to the processing of duplicate requests. It is important for users to upgrade to a patched version of Apache Tomcat to mitigate this vulnerability. If immediate upgrading is not possible, disabling the native APR connector and using the pure Java connector can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat versions 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15 are affected when using the native APR connector.
An attacker can exploit this vulnerability by sending an empty request to the SSL port of a vulnerable Apache Tomcat instance using netcat or similar tools.
The vulnerability can lead to the processing of duplicate requests, which may cause unexpected behavior or resource exhaustion.
Yes, a possible workaround is to disable the native APR connector and use the pure Java connector instead. However, this may impact performance and scalability.
To fix this vulnerability, it is recommended to upgrade to a patched version of Apache Tomcat.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
