Rule Category

SERVER-APACHE -- Snort has detected traffic exploiting vulnerabilities in Apache servers.

Alert Message

SERVER-APACHE Apache Tomcat chunked transfer encoding denial of service attempt

Rule Explanation

This event is generated when an attempt to exploit the vulnerability outlined in CVE-2014-0227 is detected. Impact: Denial of Service Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE Additional Information

CVE-2014-0227
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Details
SeverityMEDIUM Base Score6.4
Impact Score4.9 Exploit Score10.0
Confidentiality ImpactNONE Integrity ImpactPARTIAL
Availability ImpactPARTIAL Access VectorNETWORK
AuthenticationNONE Ease of AccessLOW