Vulnerability CVE-2017-6056

Vulnerability Name:

CVE-2017-6056 (CCN-122312)

Assigned:

2017-02-16

Published:

2017-02-16

Updated:

2019-10-03

Summary:

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-835

Vulnerability Consequences:

Denial of Service

References:

Vulnerable Configuration:

Configuration 1:

cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:tomcat:6:*:*:*:*:*:*:*

OR cpe:/a:apache:tomcat:7:*:*:*:*:*:*:*

AND

cpe:/a:ibm:rational_build_forge:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.1:*:*:*:*:*:*:*

OR cpe:/a:redhat:jboss_enterprise_application_platform:6:*:el6:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_build_forge:8.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_build_forge:8.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:3.0.0.4:-:community:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:openpages_grc_platform:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_build_forge:8.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_build_forge:8.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:redhat:jboss_enterprise_application_platform:6.4.14:*:*:*:*:*:*:*

OR cpe:/a:redhat:jboss_enterprise_application_platform:6.4.13:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium_big_data_intelligence:3.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.cisecurity:def:1880	P	DSA-3788-1 -- tomcat8 -- security update	2017-03-10
oval:org.cisecurity:def:1877	P	DSA-3787-1 -- tomcat7 -- security update	2017-03-10
oval:com.ubuntu.artful:def:20176056000	V	CVE-2017-6056 on Ubuntu 17.10 (artful) - medium.	2017-02-17
oval:com.ubuntu.trusty:def:20176056000	V	CVE-2017-6056 on Ubuntu 14.04 LTS (trusty) - medium.	2017-02-17
oval:com.ubuntu.cosmic:def:201760560000000	V	CVE-2017-6056 on Ubuntu 18.10 (cosmic) - medium.	2017-02-17
oval:com.ubuntu.bionic:def:20176056000	V	CVE-2017-6056 on Ubuntu 18.04 LTS (bionic) - medium.	2017-02-17
oval:com.ubuntu.xenial:def:20176056000	V	CVE-2017-6056 on Ubuntu 16.04 LTS (xenial) - medium.	2017-02-17
oval:com.ubuntu.bionic:def:201760560000000	V	CVE-2017-6056 on Ubuntu 18.04 LTS (bionic) - medium.	2017-02-17
oval:com.ubuntu.cosmic:def:20176056000	V	CVE-2017-6056 on Ubuntu 18.10 (cosmic) - medium.	2017-02-17
oval:com.ubuntu.xenial:def:201760560000000	V	CVE-2017-6056 on Ubuntu 16.04 LTS (xenial) - medium.	2017-02-17
oval:com.ubuntu.precise:def:20176056000	V	CVE-2017-6056 on Ubuntu 12.04 LTS (precise) - medium.	2017-02-17

BACK