Message-Id: <E1Ouo48-0000F5-I2@titan.mandriva.com>
Date: Sun, 12 Sep 2010 17:02:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:176 ] tomcat5

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:176
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : tomcat5
 Date    : September 12, 2010
 Affected: 2008.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in tomcat5:
 
 Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0
 through 4.1.36 does not properly handle (1) double quote (") characters
 or (2) \%5C (encoded backslash) sequences in a cookie value, which
 might cause sensitive information such as session IDs to be leaked
 to remote attackers and enable session hijacking attacks.  NOTE:
 this issue exists because of an incomplete fix for CVE-2007-3385
 (CVE-2007-5333).
 
 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through
 6.0.18, and possibly earlier versions normalizes the target pathname
 before filtering the query string when using the RequestDispatcher
 method, which allows remote attackers to bypass intended access
 restrictions and conduct directory traversal attacks via .. (dot dot)
 sequences and the WEB-INF directory in a Request (CVE-2008-5515).
 
 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0
 through 6.0.18, when the Java AJP connector and mod_jk load balancing
 are used, allows remote attackers to cause a denial of service
 (application outage) via a crafted request with invalid headers,
 related to temporary blocking of connectors that have encountered
 errors, as demonstrated by an error involving a malformed HTTP Host
 header (CVE-2009-0033).
 
 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and
 6.0.0 through 6.0.18, when FORM authentication is used, allows
 remote attackers to enumerate valid usernames via requests to
 /j_security_check with malformed URL encoding of passwords, related to
 improper error checking in the (1) MemoryRealm, (2) DataSourceRealm,
 and (3) JDBCRealm authentication realms, as demonstrated by a \%
 (percent) value for the j_password parameter (CVE-2009-0580).
 
 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0
 through 6.0.18 permits web applications to replace an XML parser used
 for other web applications, which allows local users to read or modify
 the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web
 applications via a crafted application that is loaded earlier than
 the target application (CVE-2009-0783).
 
 Directory traversal vulnerability in Apache Tomcat 5.5.0 through
 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or
 overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file,
 as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693).
 
 The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and
 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase
 files that remain from a failed undeploy, which might allow remote
 attackers to bypass intended authentication requirements via HTTP
 requests (CVE-2009-2901).
 
 Directory traversal vulnerability in Apache Tomcat 5.5.0 through
 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete
 work-directory files via directory traversal sequences in a WAR
 filename, as demonstrated by the ...war filename (CVE-2009-2902).
 
 Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might
 allow remote attackers to discover the server's hostname or IP
 address by sending a request for a resource that requires (1) BASIC or
 (2) DIGEST authentication, and then reading the realm field in the
 WWW-Authenticate header in the reply (CVE-2010-1157).
 
 Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0
 beta does not properly handle an invalid Transfer-Encoding header,
 which allows remote attackers to cause a denial of service (application
 outage) or obtain sensitive information via a crafted header that
 interferes with recycling of a buffer. (CVE-2010-2227)
 
 Packages for 2008.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5515
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0033
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0580
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0783
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2901
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2902
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1157
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2227
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 b7ec529ef67655e138bb9845381dafe0  2008.0/i586/tomcat5-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 7480f62988c594c5e963968a5d8a760c  2008.0/i586/tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 81f00d0be9c8fad809640b83015fd73e  2008.0/i586/tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 5e2b03d332177ca8f1b59b672e568028  2008.0/i586/tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 fd942acf4a4b56c678cf8dc46b3cf23b  2008.0/i586/tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 482cfd3a9f47ccfc8ed33e29918bd131  2008.0/i586/tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 97a9df65785526f25233c22c1c077eab  2008.0/i586/tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 cb9a2042c893f1818bef3fdec427da8b  2008.0/i586/tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 41e632f8c33e4c0d0d8106fbd4b1448f  2008.0/i586/tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 9c9ae10e58d6cf12b64400d3ba3c8895  2008.0/i586/tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 9967a35bf6a073e8a8509da3c5a42559  2008.0/i586/tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm 
 723023ef6f65aee545713e42809d5b86  2008.0/SRPMS/tomcat5-5.5.23-9.2.10.3mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 4b424c91fb912dc8d58ecfaf887a730c  2008.0/x86_64/tomcat5-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 ca5003fcc1480d072729f2e3a01f374c  2008.0/x86_64/tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 83c84b3c3543e561be43c439931432e5  2008.0/x86_64/tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 e2a2adee1147b24791cdbc9612bbf812  2008.0/x86_64/tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 a31a7de061b6d692924e2be3b3ee2a9c  2008.0/x86_64/tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 42dff6a2eecaeb735dae70ffa28bfd83  2008.0/x86_64/tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 31da50a7f741eee25f7d3920ece1531c  2008.0/x86_64/tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 1670728be5615301bb60b2b01b993a1e  2008.0/x86_64/tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 ee4c0935479f16f258c78ba2c5225e84  2008.0/x86_64/tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 3383de2b3f2953ee01020d9b502900b3  2008.0/x86_64/tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 b4fcecfae58187c2e0f644f569969ca6  2008.0/x86_64/tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm 
 723023ef6f65aee545713e42809d5b86  2008.0/SRPMS/tomcat5-5.5.23-9.2.10.3mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMjL+MmqjQ0CJFipgRAu5tAJ9opOdrTTLzYdyAcuZx+7WfwtcLbQCeOTn4
cZE6uUZ95kih/bicVxL4f/c=
=OWxp
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists