CVE-2016-3092

Published: Jul 4, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Affected (94)

Products: Hp: Icewall Identity Manager, Icewall Sso Agent Option · Apache: Tomcat, Commons Fileupload · Debian: Debian Linux · +1 more

Show all products

Hp: Icewall Identity Manager, Icewall Sso Agent Option · Apache: Tomcat, Commons Fileupload · Debian: Debian Linux · Canonical: Ubuntu Linux

2 products

Icewall Identity Manager

Icewall Sso Agent Option

2 products

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hp Icewall Identity Manager	Version 5.0
Hp Icewall Sso Agent Option	Version 10.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone6

Configuration C

27 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 8.0.0 rc10
Apache Tomcat	Version 8.0.0 rc1
Apache Tomcat	Version 8.0.0 rc2
Apache Tomcat	Version 8.0.0 rc5
Apache Tomcat	Version 8.0.11
Apache Tomcat	Version 8.0.12
Apache Tomcat	Version 8.0.14
Apache Tomcat	Version 8.0.15
Apache Tomcat	Version 8.0.17
Apache Tomcat	Version 8.0.18
Apache Tomcat	Version 8.0.1
Apache Tomcat	Version 8.0.20
Apache Tomcat	Version 8.0.21
Apache Tomcat	Version 8.0.22
Apache Tomcat	Version 8.0.23
Apache Tomcat	Version 8.0.24
Apache Tomcat	Version 8.0.26
Apache Tomcat	Version 8.0.27
Apache Tomcat	Version 8.0.28
Apache Tomcat	Version 8.0.29
Apache Tomcat	Version 8.0.30
Apache Tomcat	Version 8.0.32
Apache Tomcat	Version 8.0.33
Apache Tomcat	Version 8.0.35
Apache Tomcat	Version 8.0.3
Apache Tomcat	Version 8.0.5
Apache Tomcat	Version 8.0.8

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 8.5.0
Apache Tomcat	Version 8.5.2

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Apache Commons Fileupload	Up to 1.3.1

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration H

53 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 7.0.0
Apache Tomcat	Version 7.0.0 beta
Apache Tomcat	Version 7.0.10
Apache Tomcat	Version 7.0.11
Apache Tomcat	Version 7.0.12
Apache Tomcat	Version 7.0.14
Apache Tomcat	Version 7.0.16
Apache Tomcat	Version 7.0.19
Apache Tomcat	Version 7.0.1
Apache Tomcat	Version 7.0.20
Apache Tomcat	Version 7.0.21
Apache Tomcat	Version 7.0.22
Apache Tomcat	Version 7.0.23
Apache Tomcat	Version 7.0.25
Apache Tomcat	Version 7.0.26
Apache Tomcat	Version 7.0.27
Apache Tomcat	Version 7.0.28
Apache Tomcat	Version 7.0.29
Apache Tomcat	Version 7.0.2
Apache Tomcat	Version 7.0.2 beta
Apache Tomcat	Version 7.0.30
Apache Tomcat	Version 7.0.32
Apache Tomcat	Version 7.0.33
Apache Tomcat	Version 7.0.34
Apache Tomcat	Version 7.0.35
Apache Tomcat	Version 7.0.37
Apache Tomcat	Version 7.0.39
Apache Tomcat	Version 7.0.40
Apache Tomcat	Version 7.0.41
Apache Tomcat	Version 7.0.42
Apache Tomcat	Version 7.0.47
Apache Tomcat	Version 7.0.4
Apache Tomcat	Version 7.0.4 beta
Apache Tomcat	Version 7.0.50
Apache Tomcat	Version 7.0.52
Apache Tomcat	Version 7.0.53
Apache Tomcat	Version 7.0.54
Apache Tomcat	Version 7.0.55
Apache Tomcat	Version 7.0.56
Apache Tomcat	Version 7.0.57
Apache Tomcat	Version 7.0.59
Apache Tomcat	Version 7.0.5
Apache Tomcat	Version 7.0.5 beta
Apache Tomcat	Version 7.0.61
Apache Tomcat	Version 7.0.62
Apache Tomcat	Version 7.0.63
Apache Tomcat	Version 7.0.64
Apache Tomcat	Version 7.0.65
Apache Tomcat	Version 7.0.67
Apache Tomcat	Version 7.0.68
Apache Tomcat	Version 7.0.69
Apache Tomcat	Version 7.0.6
Apache Tomcat	Version 7.0.8

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (98)

http://jvn.jp/en/jp/JVN89379547/index.html

Source: secalert@redhat.com

Vendor Advisory

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121

Source: secalert@redhat.com

VDB EntryVendor Advisory

http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E

Source: secalert@redhat.com

Mailing List

http://rhn.redhat.com/errata/RHSA-2016-2068.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2069.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2070.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2071.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2072.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2599.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2807.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2808.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2017-0457.html

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1743480

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1743722

Source: secalert@redhat.com

Vendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=1743738

Source: secalert@redhat.com

Vendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=1743742

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/security-7.html

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/security-8.html

Source: secalert@redhat.com

Vendor Advisory

http://tomcat.apache.org/security-9.html

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2016/dsa-3609

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3611

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3614

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91453

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036427

Source: secalert@redhat.com

http://www.securitytracker.com/id/1036900

Source: secalert@redhat.com

http://www.securitytracker.com/id/1037029

Source: secalert@redhat.com

http://www.securitytracker.com/id/1039606

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-3024-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3027-1

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:0455

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:0456

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1349468

Source: secalert@redhat.com

Issue Tracking

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371

Source: secalert@redhat.com

PatchPermissions RequiredThird Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759

Source: secalert@redhat.com

https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201705-09

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202107-39

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20190212-0001/

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: secalert@redhat.com

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: secalert@redhat.com

http://jvn.jp/en/jp/JVN89379547/index.html