Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2016.1651 tomcat7 security update 4 July 2016 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: tomcat7 Publisher: Debian Operating System: Debian GNU/Linux 8 Impact/Access: Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2016-3092 Reference: ESB-2016.1638 ESB-2016.1625 ESB-2016.1583 Original Bulletin: http://www.debian.org/security/2016/dsa-3614 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-3614-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 02, 2016 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : tomcat7 CVE ID : CVE-2016-3092 The TERASOLUNA Framework Development Team discovered a denial of service vulnerability in Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications. A remote attacker can take advantage of this flaw by sending file upload requests that cause the HTTP server using the Apache Commons Fileupload library to become unresponsive, preventing the server from servicing other requests. Apache Tomcat uses a package renamed copy of Apache Commons FileUpload to implement the file upload requirements of the Servlet specification and is therefore also vulnerable to the denial of service vulnerability. For the stable distribution (jessie), this problem has been fixed in version 7.0.56-3+deb8u3. For the testing distribution (stretch), this problem has been fixed in version 7.0.70-1. For the unstable distribution (sid), this problem has been fixed in version 7.0.70-1. We recommend that you upgrade your tomcat7 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJXd7YhAAoJEAVMuPMTQ89Emg0P/2K7qVBmKMDG93HhWe2e5QXk I748PwHm7uHV5qrIYGS8n1LDhqNxOyMaGVJdHzJAvuOJYOVsq2RXLXAhNSNZLPgr mrOCB6i6u1ogY9ztsQi5zprhl6v0AINpQA1pP30COmiS/QlUUbGV09Z952Gg/d25 JDEpvkDmiknAKySP8Jm3GjqhYnJdyOnkRpT/PyJCfepBFk2ToR0HHOPw7kSxkCFV SM8E0ljjrZZVKQ5SRD18egi5VjnV7R/pm+MuejfdtdA+eA/UsrUeQH0kVWNN8LUP Hfry2Dz11tAi8WfdP9nc4cPm9m1XLG4S64J3ZwwUNzyuxYXpkyzKIViQDuO4WHMR vKZpUjYuRcSGqySdhN2HdYxgZET3avO20tN39+iH2ASuv5LDZJ6tOQXX713+Xox1 988nMEDkxIWbgPgfIhEhPIRoW8efEAczHoY80XxjAPJF9PokCqN5OjFBQPS60D3z zycu8+Hrxlx3C8emkVElDaFeyTmWYrMxJ/yEBEN+m0dhMdbzcwlXTAtLgrXkQUga Ly8RmMpougmN0Kx0CqCwYKyxzn7peSi2LP90gfHu5etks3rtN122c2R69Ma1DbXh mEMj0K9R2qjKFJeZ9fIU7Gxx9+Wo0dJnlEMc3jL2Ne36HBrcP3fQuKnQxw2lWbaP yL3atzZ13OmvyxAJltuN =RBqU - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBV3mqcIx+lLeg9Ub1AQgfQA//Qq7JHynX3rUci4bXBnZMZrAWdXYYoCI/ WYKB5EFDAMfVH5EjNhmnRwr1fac4eQ7l3NNrKGAuuTZPJ+gI7j4Ok4wetNhWeX7B ek+fh4cQxaVzEQLPyC4QqRoro6ArxLaCGkcbvQCVzv8xn6tyZGk+M2GGgjg1TB6u xSlV5rfszWeN5w5hwc6uKMe49u+K24/HzhYBQ+qEIQwbkHkzmIrrSoOEfBUv5ehc aYbTjth2dinyH99jnsLiYF3oVK/EUj2fO0h9AnWLUxc+WPQP8LLSVIed06DRxKFx gIf3r+mcJSavju118twjHsq2NzCdJkvprXLHs4DDBxEP1WeCeR4aU+6rLdvsEzpd CXXMZ8OVQHgsc7zh9mvydFZfnpu2EYtPZgH/kKN4GlDUfOfNLI/zhlzK7KljnLdB Ydv4fmLoFzS4EMRQ96nQKo4BNjJgfcYE+DKfX9VRAmnrA/uFtiW29KcNCO1GjNeZ 3eUOeNTAeQLoVszWBRyaJ5Bn13Mz5m7wlyU0eozWfV1y4drcWGxdxHqiagk4KagA uft5BGhgmC/r2DXWaF1hQHzZMjSNgdVNjaV0mSABhUe9q8FFTKwY/TcSkBN3KTSD pWcsB55HfDEdDe/D0c4teQtCNn1Svrxk7wLr7bxOnX2o58JRdySqjJyq6SBg8rpy wvte5wddO6s= =Bf4S -----END PGP SIGNATURE-----