Mageia alert MGASA-2012-0189 (tomcat6)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2012-0189: tomcat6-6.0.35-0.3.mga1 (1/core) | |
| Date: | Thu, 2 Aug 2012 20:49:22 +0200 | |
| Message-ID: | <20120802184922.GA20825@valstar.mageia.org> |
MGASA-2012-0189 Date: August 2nd, 2012 Affected releases: 1 Description: Updated tomcat6 packages fix security vulnerabilities: Multiple flaws were found in the way Tomcat handled HTTP DIGEST authentication. These flaws weakened the Tomcat HTTP DIGEST authentication implementation, subjecting it to some of the weaknesses of HTTP BASIC authentication, for example, allowing remote attackers to perform session replay attacks (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064). A flaw was found in the Tomcat MemoryUserDatabase. If a runtime exception occurred when creating a new user with a JMX client, that user's password was logged to Tomcat log files. Note: By default, only administrators have access to such log files (CVE-2011-2204). A flaw was found in the way Tomcat handled sendfile request attributes when using the HTTP APR or NIO (Non-Blocking I/O) connector. A malicious web application running on a Tomcat instance could use this flaw to bypass security manager restrictions and gain access to files it would otherwise be unable to access, or possibly terminate the Java Virtual Machine (JVM). The HTTP blocking IO (BIO) connector, which is not vulnerable to this issue, is used by default in Red Hat Enterprise Linux 6 (CVE-2011-2526). It was discovered that Tomcat incorrectly performed certain caching and recycling operations. A remote attacker could use this flaw to obtain read access to IP address and HTTP header information in certain cases. This issue only applied to Ubuntu 11.10 (CVE-2011-3375). A flaw was found in the way the Coyote (org.apache.coyote.ajp.AjpProcessor) and APR (org.apache.coyote.ajp.AjpAprProcessor) Tomcat AJP (Apache JServ Protocol) connectors processed certain POST requests. An attacker could send a specially-crafted request that would cause the connector to treat the message body as a new request. This allows arbitrary AJP messages to be injected, possibly allowing an attacker to bypass a web application's authentication checks and gain access to information they would otherwise be unable to access. The JK (org.apache.jk.server.JkCoyoteHandler) connector is used by default when the APR libraries are not present. The JK connector is not affected by this flaw (CVE-2011-3190). It was discovered that Tomcat computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker could cause a denial of service by sending many crafted parameters (CVE-2011-4858). It was discovered that Tomcat incorrectly handled parameters. A remote attacker could cause a denial of service by sending requests with a large number of parameters and values (CVE-2012-0022). Additionally, errors caused by incorrect permissions on the /usr/share/tomcat6/work directory have been fixed. Updated Packages: tomcat6-6.0.35-0.3.mga1 tomcat6-admin-webapps-6.0.35-0.3.mga1 tomcat6-docs-webapp-6.0.35-0.3.mga1 tomcat6-el-2.1-api-6.0.35-0.3.mga1 tomcat6-javadoc-6.0.35-0.3.mga1 tomcat6-jsp-2.1-api-6.0.35-0.3.mga1 tomcat6-lib-6.0.35-0.3.mga1 tomcat6-servlet-2.5-api-6.0.35-0.3.mga1 tomcat6-webapps-6.0.35-0.3.mga1 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1184 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2526 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3190 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4858 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0022 https://rhn.redhat.com/errata/RHSA-2011-1780.html http://www.ubuntu.com/usn/usn-1359-1/ http://tomcat.apache.org/security-6.html https://bugs.mageia.org/show_bug.cgi?id=5261 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-...