Vulnerability & Exploit Database

Back to search

Apache Tomcat Transfer-Encoding Information Disclosure and DoS

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name

auxiliary/dos/http/apache_tomcat_transfer_encoding

Authors

  • Steve Jones
  • Hoagie <andi [at] void.at>
  • Paulino Calderon <calderon [at] websec.mx>

References

Reliability

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/dos/http/apache_tomcat_transfer_encoding msf auxiliary(apache_tomcat_transfer_encoding) > show actions ...actions... msf auxiliary(apache_tomcat_transfer_encoding) > set ACTION <action-name> msf auxiliary(apache_tomcat_transfer_encoding) > show options ...show and set options... msf auxiliary(apache_tomcat_transfer_encoding) > run

Related Vulnerabilities