Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-wr3m-gw98-mc3j
Advisory ID github_osv/GHSA-wr3m-gw98-mc3j
Aliases CVE-2011-4858
Summary Improper Input Validation in Apache Tomcat Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106@apache.org%3e
http://marc.info/?l=bugtraq&m=132871655717248&w=2
http://marc.info/?l=bugtraq&m=133294394108746&w=2
http://marc.info/?l=bugtraq&m=136485229118404&w=2
https://bugzilla.redhat.com/show_bug.cgi?id=750521
https://github.com/apache/tomcat
https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18886
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html
http://www.debian.org/security/2012/dsa-2401
http://www.kb.cert.org/vuls/id/903934
http://www.nruns.com/_downloads/advisory28122011.pdf
CVE-2011-4858 https://nvd.nist.gov/vuln/detail/CVE-2011-4858
CVE-2011-4885;OSVDB-78115 Exploit http://www.ocert.org/advisories/ocert-2011-003.html
RHSA-2012-0074.html http://rhn.redhat.com/errata/RHSA-2012-0074.html
RHSA-2012-0075.html http://rhn.redhat.com/errata/RHSA-2012-0075.html
RHSA-2012-0076.html http://rhn.redhat.com/errata/RHSA-2012-0076.html
Data source Metasploit
Description This module uses a denial-of-service (DoS) condition appearing in a variety of programming languages. This vulnerability occurs when storing multiple values in a hash table and all values have the same hash value. This can cause a web server parsing the POST parameters issued with a request into a hash table to consume hours of CPU with a single HTTP request. Currently, only the hash functions for PHP and Java are implemented. This module was tested with PHP + httpd, Tomcat, Glassfish and Geronimo. It also generates a random payload to bypass some IDS signatures.
Note 
Stability:
  - crash-service-down
SideEffects: []
Reliability: []
Ransomware campaign use Unknown
Source publication date Dec. 28, 2011
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/hashcollision_dos.rb
Data source Exploit-DB
Date added July 14, 2006
Description MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection
Ransomware campaign use Known
Source publication date July 15, 2006
Exploit type webapps
Platform php
Source update date Nov. 9, 2016

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.