Vulnerability Description
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hp | Icewall Identity Manager | 5.0 |
| Hp | Icewall Sso Agent Option | 10.0 |
| Apache | Tomcat | 9.0.0 |
| Debian | Debian Linux | 8.0 |
| Apache | Commons Fileupload | <= 1.3.1 |
| Canonical | Ubuntu Linux | 12.04 |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN89379547/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121VDB EntryVendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
- http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPqMailing List
- http://rhn.redhat.com/errata/RHSA-2016-2068.html
- http://rhn.redhat.com/errata/RHSA-2016-2069.html
- http://rhn.redhat.com/errata/RHSA-2016-2070.html
- http://rhn.redhat.com/errata/RHSA-2016-2071.html
- http://rhn.redhat.com/errata/RHSA-2016-2072.html
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://svn.apache.org/viewvc?view=revision&revision=1743480
- http://svn.apache.org/viewvc?view=revision&revision=1743722Vendor Advisory
FAQ
What is CVE-2016-3092?
CVE-2016-3092 is a vulnerability with a CVSS score of 7.5 (HIGH). The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allo...
How severe is CVE-2016-3092?
CVE-2016-3092 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-3092?
Check the references section above for vendor advisories and patch information. Affected products include: Hp Icewall Identity Manager, Hp Icewall Sso Agent Option, Apache Tomcat, Debian Debian Linux, Apache Commons Fileupload.