CVEs-PoC/2014/CVE-2014-0075.md

CVE-2014-0075

Description

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

POC

Reference

• http://seclists.org/fulldisclosure/2014/Dec/23
• http://seclists.org/fulldisclosure/2014/Dec/23
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
• http://www.vmware.com/security/advisories/VMSA-2014-0012.html
• http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Github

No PoCs found on GitHub currently.