Sid 1-52471

Rule Documentation
References

Rule Category

SERVER-APACHE -- Snort has detected traffic exploiting vulnerabilities in Apache servers.

Alert Message

SERVER-APACHE Apache Tomcat chunked transfer encoding denial of service attempt

Rule Explanation

This event is generated when an attempt to exploit the vulnerability outlined in CVE-2014-0227 is detected. Impact: Denial of Service Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2014-0227

CVE Additional Information

CVE-2014-0227

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

Details
Severity	MEDIUM	Base Score	6.4
Impact Score	4.9	Exploit Score	10.0
Confidentiality Impact	NONE	Integrity Impact	PARTIAL
Availability Impact	PARTIAL	Access Vector	NETWORK
Authentication	NONE	Ease of Access	LOW