copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2012.0488 - [RedHat] Apache Tomcat: Multiple vulnerabilities

Date: 22 May 2012
References: ESB-2011.0726  ASB-2011.0064.2  ESB-2011.0880  ESB-2011.0975  ESB-2011.1197  ESB-2011.1271  ESB-2012.0067  ESB-2012.0073  ESB-2012.0102  ESB-2012.0103  
ESB-2012.0112.2  ESB-2012.0122  ESB-2012.0216  ESB-2012.0239  ESB-2012.0299  ESB-2012.0365  ESB-2012.0837.2  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0488
               Moderate: tomcat security and bug fix update
                                22 May 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Apache Tomcat 5
                   Apache Tomcat 6
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Access Privileged Data   -- Remote/Unauthenticated
                   Access Confidential Data -- Remote/Unauthenticated
                   Unauthorised Access      -- Remote/Unauthenticated
                   Denial of Service        -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-0022 CVE-2011-5064 CVE-2011-5063
                   CVE-2011-5062 CVE-2011-4858 CVE-2011-3375
                   CVE-2011-3190 CVE-2011-2526 CVE-2011-2204
                   CVE-2011-1184  

Reference:         ASB-2011.0064.2
                   ESB-2012.0365
                   ESB-2012.0299
                   ESB-2012.0239
                   ESB-2012.0216
                   ESB-2012.0122
                   ESB-2012.0112.2
                   ESB-2012.0103
                   ESB-2012.0102
                   ESB-2012.0073
                   ESB-2012.0067
                   ESB-2011.1271
                   ESB-2011.1197
                   ESB-2011.0975
                   ESB-2011.0880
                   ESB-2011.0726
                   ESB-2011.0673

Original Bulletin: 
   https://rhn.redhat.com/errata/RHSA-2012-0679.html
   https://rhn.redhat.com/errata/RHSA-2012-0681.html

Comment: This bulletin contains two (2) Red Hat security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: tomcat5 security and bug fix update
Advisory ID:       RHSA-2012:0679-01
Product:           JBoss Enterprise Web Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-0679.html
Issue date:        2012-05-21
CVE Names:         CVE-2011-1184 CVE-2011-2204 CVE-2011-2526 
                   CVE-2011-3190 CVE-2011-4858 CVE-2011-5062 
                   CVE-2011-5063 CVE-2011-5064 CVE-2012-0022 
=====================================================================

1. Summary:

An update for the Apache Tomcat 5 component for JBoss Enterprise Web Server
1.0.2 that fixes multiple security issues and two bugs is now available
from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

JBoss Enterprise Web Server includes the Tomcat Native library, providing
Apache Portable Runtime (APR) support for Tomcat. References in this text
to APR refer to the Tomcat Native implementation, not any other apr
package.

This update includes bug fixes as documented in JBPAPP-4873 and
JBPAPP-6133. It also resolves the following security issues:

Multiple flaws were found in the way Tomcat handled HTTP DIGEST
authentication. These flaws weakened the Tomcat HTTP DIGEST authentication
implementation, subjecting it to some of the weaknesses of HTTP BASIC
authentication, for example, allowing remote attackers to perform session
replay attacks. (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,
CVE-2011-5064)

A flaw was found in the way the Coyote (org.apache.coyote.ajp.AjpProcessor)
and APR (org.apache.coyote.ajp.AjpAprProcessor) Tomcat AJP (Apache JServ
Protocol) connectors processed certain POST requests. An attacker could
send a specially-crafted request that would cause the connector to treat
the message body as a new request. This allows arbitrary AJP messages to be
injected, possibly allowing an attacker to bypass a web application's
authentication checks and gain access to information they would otherwise
be unable to access. The JK (org.apache.jk.server.JkCoyoteHandler)
connector is used by default when the APR libraries are not present. The JK
connector is not affected by this flaw. (CVE-2011-3190)

It was found that the Java hashCode() method implementation was susceptible
to predictable hash collisions. A remote attacker could use this flaw to
cause Tomcat to use an excessive amount of CPU time by sending an HTTP
request with a large number of parameters whose names map to the same hash
value. This update introduces a limit on the number of parameters processed
per request to mitigate this issue. The default limit is 512 for parameters
and 128 for headers. These defaults can be changed by setting the
org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

It was found that Tomcat did not handle large numbers of parameters and
large parameter values efficiently. A remote attacker could make Tomcat use
an excessive amount of CPU time by sending an HTTP request containing a
large number of parameters or large parameter values. This update
introduces limits on the number of parameters and headers processed per
request to address this issue. Refer to the CVE-2011-4858 description for
information about the org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

A flaw was found in the Tomcat MemoryUserDatabase. If a runtime exception
occurred when creating a new user with a JMX client, that user's password
was logged to Tomcat log files. Note: By default, only administrators have
access to such log files. (CVE-2011-2204)

A flaw was found in the way Tomcat handled sendfile request attributes
when using the HTTP APR or NIO (Non-Blocking I/O) connector. A malicious
web application running on a Tomcat instance could use this flaw to bypass
security manager restrictions and gain access to files it would otherwise
be unable to access, or possibly terminate the Java Virtual Machine (JVM).
The HTTP NIO connector is used by default in JBoss Enterprise Web Server.
(CVE-2011-2526)

Red Hat would like to thank oCERT for reporting CVE-2011-4858, and the
Apache Tomcat project for reporting CVE-2011-2526. oCERT acknowledges
Julian Wälde and Alexander Klink as the original reporters of
CVE-2011-4858.

All users of JBoss Enterprise Web Server 1.0.2 as provided from the Red Hat
Customer Portal are advised to apply this update.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files).

Tomcat must be restarted for this update to take effect.

4. Bugs fixed (http://bugzilla.redhat.com/):

717013 - CVE-2011-2204 tomcat: password disclosure vulnerability
720948 - CVE-2011-2526 tomcat: security manager restrictions bypass
734868 - CVE-2011-3190 tomcat: authentication bypass and information disclosure
741401 - CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 tomcat: Multiple weaknesses in HTTP DIGEST authentication
750521 - CVE-2011-4858 tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)
783359 - CVE-2012-0022 tomcat: large number of parameters DoS
5. References:

https://www.redhat.com/security/data/cve/CVE-2011-1184.html
https://www.redhat.com/security/data/cve/CVE-2011-2204.html
https://www.redhat.com/security/data/cve/CVE-2011-2526.html
https://www.redhat.com/security/data/cve/CVE-2011-3190.html
https://www.redhat.com/security/data/cve/CVE-2011-4858.html
https://www.redhat.com/security/data/cve/CVE-2011-5062.html
https://www.redhat.com/security/data/cve/CVE-2011-5063.html
https://www.redhat.com/security/data/cve/CVE-2011-5064.html
https://www.redhat.com/security/data/cve/CVE-2012-0022.html
https://access.redhat.com/security/updates/classification/#moderate
http://tomcat.apache.org/security-5.html
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=1.0.2
https://issues.jboss.org/browse/JBPAPP-4873
https://issues.jboss.org/browse/JBPAPP-6133

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPunkDXlSAg2UNWIIRArNyAJ9HvZnDjKNgx3KRf7aH4T/V8cp6sACeMtrc
Cdkab+W+Hzim/IX+j30WFj4=
=81lW
- -----END PGP SIGNATURE-----

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: tomcat6 security and bug fix update
Advisory ID:       RHSA-2012:0681-01
Product:           JBoss Enterprise Web Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-0681.html
Issue date:        2012-05-21
CVE Names:         CVE-2011-1184 CVE-2011-2204 CVE-2011-2526 
                   CVE-2011-3190 CVE-2011-3375 CVE-2011-4858 
                   CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 
                   CVE-2012-0022 
=====================================================================

1. Summary:

An update for the Apache Tomcat 6 component for JBoss Enterprise Web Server
1.0.2 that fixes multiple security issues and three bugs is now available
from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Description:

Apache Tomcat is a servlet container.

JBoss Enterprise Web Server includes the Tomcat Native library, providing
Apache Portable Runtime (APR) support for Tomcat. References in this text
to APR refer to the Tomcat Native implementation, not any other apr
package.

This update fixes the JBPAPP-4873, JBPAPP-6133, and JBPAPP-6852 bugs. It
also resolves the following security issues:

Multiple flaws weakened the Tomcat HTTP DIGEST authentication
implementation, subjecting it to some of the weaknesses of HTTP BASIC
authentication, for example, allowing remote attackers to perform session
replay attacks. (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,
CVE-2011-5064)

A flaw was found in the way the Coyote (org.apache.coyote.ajp.AjpProcessor)
and APR (org.apache.coyote.ajp.AjpAprProcessor) Tomcat AJP (Apache JServ
Protocol) connectors processed certain POST requests. An attacker could
send a specially-crafted request that would cause the connector to treat
the message body as a new request. This allows arbitrary AJP messages to be
injected, possibly allowing an attacker to bypass a web application's
authentication checks and gain access to information they would otherwise
be unable to access. The JK (org.apache.jk.server.JkCoyoteHandler)
connector is used by default when the APR libraries are not present. The JK
connector is not affected by this flaw. (CVE-2011-3190)

A flaw in the way Tomcat recycled objects that contain data from user
requests (such as IP addresses and HTTP headers) when certain errors
occurred. If a user sent a request that caused an error to be logged,
Tomcat would return a reply to the next request (which could be sent by a
different user) with data from the first user's request, leading to
information disclosure. Under certain conditions, a remote attacker could
leverage this flaw to hijack sessions. (CVE-2011-3375)

The Java hashCode() method implementation was susceptible to predictable
hash collisions. A remote attacker could use this flaw to cause Tomcat to
use an excessive amount of CPU time by sending an HTTP request with a large
number of parameters whose names map to the same hash value. This update
introduces a limit on the number of parameters processed per request to
mitigate this issue. The default limit is 512 for parameters and 128 for
headers. These defaults can be changed by setting the
org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

Tomcat did not handle large numbers of parameters and large parameter
values efficiently. A remote attacker could make Tomcat use an excessive
amount of CPU time by sending an HTTP request containing a large number of
parameters or large parameter values. This update introduces limits on the
number of parameters and headers processed per request to address this
issue. Refer to the CVE-2011-4858 description for information about the
org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

A flaw in the Tomcat MemoryUserDatabase. If a runtime exception occurred
when creating a new user with a JMX client, that user's password was logged
to Tomcat log files. Note: By default, only administrators have access to
such log files. (CVE-2011-2204)

A flaw in the way Tomcat handled sendfile request attributes when using the
HTTP APR or NIO (Non-Blocking I/O) connector. A malicious web application
running on a Tomcat instance could use this flaw to bypass security manager
restrictions and gain access to files it would otherwise be unable to
access, or possibly terminate the Java Virtual Machine (JVM). The HTTP NIO
connector is used by default in JBoss Enterprise Web Server.
(CVE-2011-2526)

Red Hat would like to thank oCERT for reporting CVE-2011-4858, and the
Apache Tomcat project for reporting CVE-2011-2526. oCERT acknowledges
Julian Wälde and Alexander Klink as the original reporters of
CVE-2011-4858.

3. Solution:

All users of JBoss Enterprise Web Server 1.0.2 as provided from the Red Hat
Customer Portal are advised to apply this update.

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files).

Tomcat must be restarted for this update to take effect.

4. Bugs fixed (http://bugzilla.redhat.com/):

717013 - CVE-2011-2204 tomcat: password disclosure vulnerability
720948 - CVE-2011-2526 tomcat: security manager restrictions bypass
734868 - CVE-2011-3190 tomcat: authentication bypass and information disclosure
741401 - CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 tomcat: Multiple weaknesses in HTTP DIGEST authentication
750521 - CVE-2011-4858 tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)
782624 - CVE-2011-3375 tomcat: information disclosure due to improper response and request object recycling
783359 - CVE-2012-0022 tomcat: large number of parameters DoS
5. References:

https://www.redhat.com/security/data/cve/CVE-2011-1184.html
https://www.redhat.com/security/data/cve/CVE-2011-2204.html
https://www.redhat.com/security/data/cve/CVE-2011-2526.html
https://www.redhat.com/security/data/cve/CVE-2011-3190.html
https://www.redhat.com/security/data/cve/CVE-2011-3375.html
https://www.redhat.com/security/data/cve/CVE-2011-4858.html
https://www.redhat.com/security/data/cve/CVE-2011-5062.html
https://www.redhat.com/security/data/cve/CVE-2011-5063.html
https://www.redhat.com/security/data/cve/CVE-2011-5064.html
https://www.redhat.com/security/data/cve/CVE-2012-0022.html
https://access.redhat.com/security/updates/classification/#moderate
http://tomcat.apache.org/security-6.html
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=1.0.2
https://issues.jboss.org/browse/JBPAPP-4873
https://issues.jboss.org/browse/JBPAPP-6133
https://issues.jboss.org/browse/JBPAPP-6852

6. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPunlvXlSAg2UNWIIRAvqnAKCFCNODTaq3A180VLq9ptMsBURTcwCgsJls
JsG5zbN8j1JMa8din0vPkdw=
=zajO
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT7sCHe4yVqjM2NGpAQLgbg//fyIMuayGQS0ApILh8Oz2nOcJIFdGPmc1
FnhS0kYJZLOLmk4niD9vUXGplKmW0TQOu5TtOKWrepX8vyfxXeQX2oPkovXXWZvb
1AmIu1+JHjqxiha+osGms4d2cj88dL76SFBCqzWfiHzd1i+MRxCDGHBweHRQYfEd
9OaziEbB3GK/pIXn/uhiUZKj8kgO8g+IsszSnCT4nYdLqSMd5qZzVjTmBKvOl2IQ
MvE5Eid3Y67qCFuXpwZSu6GQiyN1KdqYtzQz8rHup9TCrl5/C+ywkRr+UiEQUDxP
UkOieQo5i71SvUSoWlhv4XQ9WTmLuGYnUWULboPMQRz6XM4+6CmbRexHZ10kRek3
UCl7neuD+liKEryRGje9zkmHe8r6xxkc6oVXS+dchIzfi9VV5nt6u/AOJOyI7Scm
+M1ibG7FemC74FRtvarSh4etpMZYlxgy1/widn8khuKj+HFbmSZCQCIUJAA5eLDn
uA/R5VqRMWUwHqVhvM2OfQ83tDP6zaSjzSLAsxKidv/r1Ma9HbxhApzJYPkj+Mcp
/bgShVb3huCzYNIzhqy3HAHs1jI2p8muZT8+HBJec562fLy/isTfJSZRkY2J1vQa
DJeyUKWa71lqjznttb/zbfgO/ZoopAMqcZm8RXXeC2TGz42Ui4rd0w1uw58goKES
JoixwmPpKhw=
=YzwC
-----END PGP SIGNATURE-----