Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.2623
Moderate: tomcat security, bug fix, and enhancement update
7 November 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tomcat
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Cross-site Request Forgery -- Remote with User Interaction
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-3092 CVE-2016-0763 CVE-2016-0714
CVE-2016-0706 CVE-2015-5351 CVE-2015-5345
CVE-2015-5174
Reference: ASB-2016.0095
ESB-2016.2588
ESB-2016.2549
ESB-2016.0769
ESB-2016.0765
ESB-2016.0440
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2016-2599.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: tomcat security, bug fix, and enhancement update
Advisory ID: RHSA-2016:2599-02
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2599.html
Issue date: 2016-11-03
CVE Names: CVE-2015-5174 CVE-2015-5345 CVE-2015-5351
CVE-2016-0706 CVE-2016-0714 CVE-2016-0763
CVE-2016-3092
=====================================================================
1. Summary:
An update for tomcat is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - noarch
Red Hat Enterprise Linux Client Optional (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch
Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Enterprise Linux Server Optional (v. 7) - noarch
Red Hat Enterprise Linux Workstation (v. 7) - noarch
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch
3. Description:
Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.
The following packages have been upgraded to a newer upstream version:
tomcat (7.0.69). (BZ#1287928)
Security Fix(es):
* A CSRF flaw was found in Tomcat's the index pages for the Manager and
Host Manager applications. These applications included a valid CSRF token
when issuing a redirect as a result of an unauthenticated request to the
root of the web application. This token could then be used by an attacker
to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could
allow a remote, authenticated user to bypass intended SecurityManager
restrictions and execute arbitrary code in a privileged context via a web
application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow
remote, authenticated users to access arbitrary application data,
potentially resulting in a denial of service. (CVE-2016-0763)
* A denial of service vulnerability was identified in Commons FileUpload
that occurred when the length of the multipart boundary was just below the
size of the buffer (4096 bytes) used to read the uploaded file if the
boundary was the typical tens of bytes long. (CVE-2016-3092)
* A directory traversal flaw was found in Tomcat's RequestUtil.java. A
remote, authenticated user could use this flaw to bypass intended
SecurityManager restrictions and list a parent directory via a '/..' in a
pathname used by a web application in a getResource, getResourceAsStream,
or getResourcePaths call. (CVE-2015-5174)
* It was found that Tomcat could reveal the presence of a directory even
when that directory was protected by a security constraint. A user could
make a request to a directory via a URL not ending with a slash and,
depending on whether Tomcat redirected that request, could confirm whether
that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by
a web application when a security manager was configured. This allowed a
web application to list all deployed web applications and expose sensitive
information such as session IDs. (CVE-2016-0706)
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.3 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1133070 - Need to include full implementation of tomcat-juli.jar and tomcat-juli-adapters.jar
1201409 - Fix the broken tomcat-jsvc service unit
1208402 - Mark web.xml in tomcat-admin-webapps as config file
1221896 - tomcat.service loads /etc/sysconfig/tomcat without shell expansion
1229476 - Tomcat startup ONLY options
1240279 - The command tomcat-digest doesn't work with RHEL 7
1265698 - CVE-2015-5174 tomcat: URL Normalization issue
1277197 - tomcat user has non-existing default shell set
1287928 - Rebase tomcat to 7.0.69 or backport features
1311076 - CVE-2015-5351 tomcat: CSRF token leak
1311082 - CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
1311087 - CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
1311089 - CVE-2015-5345 tomcat: directory disclosure
1311093 - CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
1311622 - Getting NoSuchElementException while handling attributes with empty string value in tomcat 7.0.54
1320853 - Add HSTS support
1327326 - rpm -V tomcat fails on /var/log/tomcat/catalina.out
1347774 - The security manager doesn't work correctly (JSPs cannot be compiled)
1347860 - The systemd service unit does not allow tomcat to shut down gracefully
1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
tomcat-7.0.69-10.el7.src.rpm
noarch:
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
tomcat-7.0.69-10.el7.src.rpm
noarch:
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
tomcat-7.0.69-10.el7.src.rpm
noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
tomcat-7.0.69-10.el7.src.rpm
noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
noarch:
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2015-5174
https://access.redhat.com/security/cve/CVE-2015-5345
https://access.redhat.com/security/cve/CVE-2015-5351
https://access.redhat.com/security/cve/CVE-2016-0706
https://access.redhat.com/security/cve/CVE-2016-0714
https://access.redhat.com/security/cve/CVE-2016-0763
https://access.redhat.com/security/cve/CVE-2016-3092
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFYGv0mXlSAg2UNWIIRAq74AJ9mIwnepxw2jbrHnfK3Gkc+N7uMIACfXM+E
5lVH/+qu5TZIB819MY4FTO0=
=u+za
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWB/Xt4x+lLeg9Ub1AQi3gw//TxbSVlH86RoBp3XP73wPxqMJ7MZjg+vB
kWSR2ZcshNlXm4ISc0il/+B1TQn/7tylu7/yZg6ImULVxvm1yrxL4PvlXjtQsmsi
a22OL2l/VETlPmaBHvMH5rOWiloTwE/dlrB2Ci309z3zPeRt58Rv6P9DiP+sarn/
W4khUtUyR5CEdJPwAKrsE9YEz/qIBp7G0XzGUUbj36B6LniPIZ+1ENQYB4XaNcDy
lLGpt6kyuOe0EhH7Oh7xMu4jiud0aFMYvYH76vbPezgduWf6F99X7TDvI5EkJPxa
3uJTExWmq73NjEc7uek3PzaJXnziDVitiHn2skvdd6dGwnyocvBHz3StBsW4A41J
cFPWj6ujWZB0I8GrD59NvoSU26oqdKAmtu4wRMnOm524atDTz4HZPACZGqxl+U62
ZKM5BVwHgJlrX4IibQ4YLaXJnSGzxiDLXu5M4cPFVDTjflDCAonJodGWRzAjMFLy
yDT2BZiQSzs1MMPQjA27rQVA4SA0KmX5/OXA24fmv07jTOpg9ZKh9Ke5MZhmZHJ9
MGWz6c2xdGPMmGR/Gnm+0TiNPgNIadI1g/4cuYJ25IqCCGz8urA9ONix+DlfWQ1d
5NjKvGobTl9lTcDqb/vkkEkrm/fErA0AR2B45JSqzEtVshwFBkcvaGFtuMeGPvzc
KY6ELvLbEEw=
=i37z
-----END PGP SIGNATURE-----