CVE-2014-0050

Published: Apr 1, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Affected (74)

Products: Oracle: Retail Applications · Apache: Commons Fileupload, Tomcat

1 product

2 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Retail Applications	Version 12.0
Oracle Retail Applications	Version 12.0in
Oracle Retail Applications	Version 13.0
Oracle Retail Applications	Version 13.1
Oracle Retail Applications	Version 13.2
Oracle Retail Applications	Version 13.3
Oracle Retail Applications	Version 13.4
Oracle Retail Applications	Version 14.0

Configuration B

66 vulnerable

Vulnerable Software	Affected Versions
Apache Commons Fileupload	Up to 1.3
Apache Commons Fileupload	Version 1.0
Apache Commons Fileupload	Version 1.1.1
Apache Commons Fileupload	Version 1.1
Apache Commons Fileupload	Version 1.2.1
Apache Commons Fileupload	Version 1.2.2
Apache Commons Fileupload	Version 1.2
Apache Tomcat	Version 7.0.0
Apache Tomcat	Version 7.0.0 beta
Apache Tomcat	Version 7.0.10
Apache Tomcat	Version 7.0.11
Apache Tomcat	Version 7.0.12
Apache Tomcat	Version 7.0.13
Apache Tomcat	Version 7.0.14
Apache Tomcat	Version 7.0.15
Apache Tomcat	Version 7.0.16
Apache Tomcat	Version 7.0.17
Apache Tomcat	Version 7.0.18
Apache Tomcat	Version 7.0.19
Apache Tomcat	Version 7.0.1
Apache Tomcat	Version 7.0.20
Apache Tomcat	Version 7.0.21
Apache Tomcat	Version 7.0.22
Apache Tomcat	Version 7.0.23
Apache Tomcat	Version 7.0.24
Apache Tomcat	Version 7.0.25
Apache Tomcat	Version 7.0.26
Apache Tomcat	Version 7.0.27
Apache Tomcat	Version 7.0.28
Apache Tomcat	Version 7.0.29
Apache Tomcat	Version 7.0.2
Apache Tomcat	Version 7.0.2 beta
Apache Tomcat	Version 7.0.30
Apache Tomcat	Version 7.0.31
Apache Tomcat	Version 7.0.32
Apache Tomcat	Version 7.0.33
Apache Tomcat	Version 7.0.34
Apache Tomcat	Version 7.0.35
Apache Tomcat	Version 7.0.36
Apache Tomcat	Version 7.0.37
Apache Tomcat	Version 7.0.38
Apache Tomcat	Version 7.0.39
Apache Tomcat	Version 7.0.3
Apache Tomcat	Version 7.0.40
Apache Tomcat	Version 7.0.41
Apache Tomcat	Version 7.0.42
Apache Tomcat	Version 7.0.43
Apache Tomcat	Version 7.0.44
Apache Tomcat	Version 7.0.45
Apache Tomcat	Version 7.0.46
Apache Tomcat	Version 7.0.47
Apache Tomcat	Version 7.0.48
Apache Tomcat	Version 7.0.49
Apache Tomcat	Version 7.0.4
Apache Tomcat	Version 7.0.4 beta
Apache Tomcat	Version 7.0.50
Apache Tomcat	Version 7.0.5
Apache Tomcat	Version 7.0.6
Apache Tomcat	Version 7.0.7
Apache Tomcat	Version 7.0.8
Apache Tomcat	Version 7.0.9
Apache Tomcat	Version 8.0.0 rc10
Apache Tomcat	Version 8.0.0 rc1
Apache Tomcat	Version 8.0.0 rc2
Apache Tomcat	Version 8.0.0 rc5
Apache Tomcat	Version 8.0.1

Related CWEs

CWE-264

References (138)

http://advisories.mageia.org/MGASA-2014-0110.html

Source: secalert@redhat.com

http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html

Source: secalert@redhat.com

Exploit

http://jvn.jp/en/jp/JVN14876762/index.html

Source: secalert@redhat.com

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143136844732487&w=2

Source: secalert@redhat.com

http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0252.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0253.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0400.html

Source: secalert@redhat.com

http://seclists.org/fulldisclosure/2014/Dec/23

Source: secalert@redhat.com

http://secunia.com/advisories/57915

Source: secalert@redhat.com

http://secunia.com/advisories/58075

Source: secalert@redhat.com

http://secunia.com/advisories/58976

Source: secalert@redhat.com

http://secunia.com/advisories/59039

Source: secalert@redhat.com

http://secunia.com/advisories/59041

Source: secalert@redhat.com

http://secunia.com/advisories/59183

Source: secalert@redhat.com

http://secunia.com/advisories/59184

Source: secalert@redhat.com

http://secunia.com/advisories/59185

Source: secalert@redhat.com

http://secunia.com/advisories/59187

Source: secalert@redhat.com

http://secunia.com/advisories/59232

Source: secalert@redhat.com

http://secunia.com/advisories/59399

Source: secalert@redhat.com

http://secunia.com/advisories/59492

Source: secalert@redhat.com

http://secunia.com/advisories/59500

Source: secalert@redhat.com

http://secunia.com/advisories/59725

Source: secalert@redhat.com

http://secunia.com/advisories/60475

Source: secalert@redhat.com

http://secunia.com/advisories/60753

Source: secalert@redhat.com

http://svn.apache.org/r1565143

Source: secalert@redhat.com

Patch

http://tomcat.apache.org/security-7.html

Source: secalert@redhat.com

PatchVendor Advisory

http://tomcat.apache.org/security-8.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21669554

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21675432

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676091

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676092

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676401

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676403

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676405

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676410

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676656

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21676853

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21677691

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21677724

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21681214

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2856

Source: secalert@redhat.com

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html

Source: secalert@redhat.com

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html

Source: secalert@redhat.com

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html

Source: secalert@redhat.com

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:084

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/532549/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/65400

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2130-1

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2014-0007.html

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2014-0008.html

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1062337

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202107-39

Source: secalert@redhat.com

http://advisories.mageia.org/MGASA-2014-0110.html