exploit the possibilities

Red Hat Security Advisory 2016-2599-02

Red Hat Security Advisory 2016-2599-02
Posted Nov 4, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-2599-02 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. The following packages have been upgraded to a newer upstream version: tomcat. Security Fix: A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.

tags | advisory, java, web, root
systems | linux, redhat
advisories | CVE-2015-5174, CVE-2015-5345, CVE-2015-5351, CVE-2016-0706, CVE-2016-0714, CVE-2016-0763, CVE-2016-3092
MD5 | 02720dea32714bccdbdb8886046cee82

Red Hat Security Advisory 2016-2599-02

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: tomcat security, bug fix, and enhancement update
Advisory ID: RHSA-2016:2599-02
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2599.html
Issue date: 2016-11-03
CVE Names: CVE-2015-5174 CVE-2015-5345 CVE-2015-5351
CVE-2016-0706 CVE-2016-0714 CVE-2016-0763
CVE-2016-3092
=====================================================================

1. Summary:

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - noarch
Red Hat Enterprise Linux Client Optional (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch
Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Enterprise Linux Server Optional (v. 7) - noarch
Red Hat Enterprise Linux Workstation (v. 7) - noarch
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch

3. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

The following packages have been upgraded to a newer upstream version:
tomcat (7.0.69). (BZ#1287928)

Security Fix(es):

* A CSRF flaw was found in Tomcat's the index pages for the Manager and
Host Manager applications. These applications included a valid CSRF token
when issuing a redirect as a result of an unauthenticated request to the
root of the web application. This token could then be used by an attacker
to perform a CSRF attack. (CVE-2015-5351)

* It was found that several Tomcat session persistence mechanisms could
allow a remote, authenticated user to bypass intended SecurityManager
restrictions and execute arbitrary code in a privileged context via a web
application that placed a crafted object in a session. (CVE-2016-0714)

* A security manager bypass flaw was found in Tomcat that could allow
remote, authenticated users to access arbitrary application data,
potentially resulting in a denial of service. (CVE-2016-0763)

* A denial of service vulnerability was identified in Commons FileUpload
that occurred when the length of the multipart boundary was just below the
size of the buffer (4096 bytes) used to read the uploaded file if the
boundary was the typical tens of bytes long. (CVE-2016-3092)

* A directory traversal flaw was found in Tomcat's RequestUtil.java. A
remote, authenticated user could use this flaw to bypass intended
SecurityManager restrictions and list a parent directory via a '/..' in a
pathname used by a web application in a getResource, getResourceAsStream,
or getResourcePaths call. (CVE-2015-5174)

* It was found that Tomcat could reveal the presence of a directory even
when that directory was protected by a security constraint. A user could
make a request to a directory via a URL not ending with a slash and,
depending on whether Tomcat redirected that request, could confirm whether
that directory existed. (CVE-2015-5345)

* It was found that Tomcat allowed the StatusManagerServlet to be loaded by
a web application when a security manager was configured. This allowed a
web application to list all deployed web applications and expose sensitive
information such as session IDs. (CVE-2016-0706)

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.3 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1133070 - Need to include full implementation of tomcat-juli.jar and tomcat-juli-adapters.jar
1201409 - Fix the broken tomcat-jsvc service unit
1208402 - Mark web.xml in tomcat-admin-webapps as config file
1221896 - tomcat.service loads /etc/sysconfig/tomcat without shell expansion
1229476 - Tomcat startup ONLY options
1240279 - The command tomcat-digest doesn't work with RHEL 7
1265698 - CVE-2015-5174 tomcat: URL Normalization issue
1277197 - tomcat user has non-existing default shell set
1287928 - Rebase tomcat to 7.0.69 or backport features
1311076 - CVE-2015-5351 tomcat: CSRF token leak
1311082 - CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
1311087 - CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
1311089 - CVE-2015-5345 tomcat: directory disclosure
1311093 - CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
1311622 - Getting NoSuchElementException while handling attributes with empty string value in tomcat 7.0.54
1320853 - Add HSTS support
1327326 - rpm -V tomcat fails on /var/log/tomcat/catalina.out
1347774 - The security manager doesn't work correctly (JSPs cannot be compiled)
1347860 - The systemd service unit does not allow tomcat to shut down gracefully
1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

noarch:
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5174
https://access.redhat.com/security/cve/CVE-2015-5345
https://access.redhat.com/security/cve/CVE-2015-5351
https://access.redhat.com/security/cve/CVE-2016-0706
https://access.redhat.com/security/cve/CVE-2016-0714
https://access.redhat.com/security/cve/CVE-2016-0763
https://access.redhat.com/security/cve/CVE-2016-3092
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFYGv0mXlSAg2UNWIIRAq74AJ9mIwnepxw2jbrHnfK3Gkc+N7uMIACfXM+E
5lVH/+qu5TZIB819MY4FTO0=
=u+za
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    11 Files
  • 17
    Sep 17th
    14 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close