Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.1651
tomcat7 security update
4 July 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tomcat7
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-3092
Reference: ESB-2016.1638
ESB-2016.1625
ESB-2016.1583
Original Bulletin:
http://www.debian.org/security/2016/dsa-3614
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3614-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 02, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : tomcat7
CVE ID : CVE-2016-3092
The TERASOLUNA Framework Development Team discovered a denial of service
vulnerability in Apache Commons FileUpload, a package to make it
easy to add robust, high-performance, file upload capability to servlets
and web applications. A remote attacker can take advantage of this flaw
by sending file upload requests that cause the HTTP server using the
Apache Commons Fileupload library to become unresponsive, preventing the
server from servicing other requests.
Apache Tomcat uses a package renamed copy of Apache Commons FileUpload
to implement the file upload requirements of the Servlet specification
and is therefore also vulnerable to the denial of service vulnerability.
For the stable distribution (jessie), this problem has been fixed in
version 7.0.56-3+deb8u3.
For the testing distribution (stretch), this problem has been fixed
in version 7.0.70-1.
For the unstable distribution (sid), this problem has been fixed in
version 7.0.70-1.
We recommend that you upgrade your tomcat7 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJXd7YhAAoJEAVMuPMTQ89Emg0P/2K7qVBmKMDG93HhWe2e5QXk
I748PwHm7uHV5qrIYGS8n1LDhqNxOyMaGVJdHzJAvuOJYOVsq2RXLXAhNSNZLPgr
mrOCB6i6u1ogY9ztsQi5zprhl6v0AINpQA1pP30COmiS/QlUUbGV09Z952Gg/d25
JDEpvkDmiknAKySP8Jm3GjqhYnJdyOnkRpT/PyJCfepBFk2ToR0HHOPw7kSxkCFV
SM8E0ljjrZZVKQ5SRD18egi5VjnV7R/pm+MuejfdtdA+eA/UsrUeQH0kVWNN8LUP
Hfry2Dz11tAi8WfdP9nc4cPm9m1XLG4S64J3ZwwUNzyuxYXpkyzKIViQDuO4WHMR
vKZpUjYuRcSGqySdhN2HdYxgZET3avO20tN39+iH2ASuv5LDZJ6tOQXX713+Xox1
988nMEDkxIWbgPgfIhEhPIRoW8efEAczHoY80XxjAPJF9PokCqN5OjFBQPS60D3z
zycu8+Hrxlx3C8emkVElDaFeyTmWYrMxJ/yEBEN+m0dhMdbzcwlXTAtLgrXkQUga
Ly8RmMpougmN0Kx0CqCwYKyxzn7peSi2LP90gfHu5etks3rtN122c2R69Ma1DbXh
mEMj0K9R2qjKFJeZ9fIU7Gxx9+Wo0dJnlEMc3jL2Ne36HBrcP3fQuKnQxw2lWbaP
yL3atzZ13OmvyxAJltuN
=RBqU
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBV3mqcIx+lLeg9Ub1AQgfQA//Qq7JHynX3rUci4bXBnZMZrAWdXYYoCI/
WYKB5EFDAMfVH5EjNhmnRwr1fac4eQ7l3NNrKGAuuTZPJ+gI7j4Ok4wetNhWeX7B
ek+fh4cQxaVzEQLPyC4QqRoro6ArxLaCGkcbvQCVzv8xn6tyZGk+M2GGgjg1TB6u
xSlV5rfszWeN5w5hwc6uKMe49u+K24/HzhYBQ+qEIQwbkHkzmIrrSoOEfBUv5ehc
aYbTjth2dinyH99jnsLiYF3oVK/EUj2fO0h9AnWLUxc+WPQP8LLSVIed06DRxKFx
gIf3r+mcJSavju118twjHsq2NzCdJkvprXLHs4DDBxEP1WeCeR4aU+6rLdvsEzpd
CXXMZ8OVQHgsc7zh9mvydFZfnpu2EYtPZgH/kKN4GlDUfOfNLI/zhlzK7KljnLdB
Ydv4fmLoFzS4EMRQ96nQKo4BNjJgfcYE+DKfX9VRAmnrA/uFtiW29KcNCO1GjNeZ
3eUOeNTAeQLoVszWBRyaJ5Bn13Mz5m7wlyU0eozWfV1y4drcWGxdxHqiagk4KagA
uft5BGhgmC/r2DXWaF1hQHzZMjSNgdVNjaV0mSABhUe9q8FFTKwY/TcSkBN3KTSD
pWcsB55HfDEdDe/D0c4teQtCNn1Svrxk7wLr7bxOnX2o58JRdySqjJyq6SBg8rpy
wvte5wddO6s=
=Bf4S
-----END PGP SIGNATURE-----