Denial of service in Apache Tomcat - CVE-2016-6817

Vulnerability identifier: #VU1185

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6817

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due to boundary error when parsing HTTP/2 headers. A remote attacker can send a specially crafted HTTP/2 header longer than available buffer and trigger infinite loop.

Successful exploitation of the vulnerability may result in denial of service.

Apache Tomcat
FlashSystem 900 9840-AE2 and 9843-AE2
FlashSystem 840 9840-AE1 & 9843-AE1
EMC Cloud Tiering Appliance
Fedora
IBM FlashSystem V9000
IBM Storwize V7000
IBM Storwize V5000
IBM SAN Volume Controller
IBM Storwize V3700
IBM Storwize V3500
tomcat

Update to version 9.0.0.M13.

IBM FlashSystem V9000 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V7000 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V5000 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM SAN Volume Controller - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V3700 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
IBM Storwize V3500 - addressed in versions 7.6.1.7, 7.7.1.6, 7.8.0.2, 7.8.1.0
tomcat - addressed in versions 8.0.39-1.fc23, 8.0.39-1.fc24, 8.0.39-1.fc25
EMC Cloud Tiering Appliance - addressed in versions 13.0.0.2.29, 13.1.0.2.20

• https://tomcat.apache.org/security-9.html
• http://svn.apache.org/viewvc?view=rev&rev=1765794

• Multiple vulnerabilities in Apache Tomcat
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance
• Multiple vulnerabilities in IBM FlashSystem models 840 and 900
• Multiple vulnerabilities in SAN Volume Controller, Storwize family and FlashSystem V9000 products
• Fedora 24 update for tomcat
• Fedora 23 update for tomcat
• Fedora 25 update for tomcat