IBM UrbanCode Deploy / UrbanCode Deploy with Patterns Apache Tomcat Chunked Request Handling Vulnerability


Description   IBM has acknowledged a vulnerability in IBM UrbanCode Deploy and UrbanCode Deploy with Patterns, which can be exploited by malicious people to bypass certain security restrictions.
For more information:
SA62768
The vulnerability is reported in the following products and versions:
* UrbanCode Deploy versions 6.0, 6.0.1, 6.0.1.1, 6.0.1.2, 6.0.1.3, 6.0.1.4, 6.0.1.5, 6.0.1.6, 6.0.1.7, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.1.0.4, 6.1.1, 6.1.1.1, and 6.1.1.2.
* UrbanCode Deploy with Patterns 6.1.0, 6.1.0.1, 6.1.0.2, and 6.1.1.
     
Vulnerable Products   Vulnerable Software:
IBM UrbanCode Deploy 6.x
     
Solution   Update to a fixed version.UrbanCode Deploy:Update to version 6.1.1.3 or 6.0.1.8.UrbanCode Deploy with Patterns:Update to version 6.1.1.1.
     
CVE   CVE-2014-0227
     
References   IBM:
https://www.ibm.com/support/docview.wss?uid=swg21701042
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
HTTP Request Smuggling : HTTP command found in header
3.2.0
HTTP Request Smuggling : Content-Length and Transfer-Encoding: chunked fields in header
3.2.0
HTTP Request Smuggling : suspicious syntax using HTTP keyword
3.2.0
HTTP Request Smuggling : multiple Content-Length fields
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2015-04-06 

 Target Type 
Server 

 Possible exploit 
Remote