Paketname
tomcat5
Datum
2010-09-12
Advisory ID
MDVSA-2010:176
Betroffene Versionen
2008.0 i586 , 2008.0 x86_64

Problembeschreibung

Multiple vulnerabilities has been found and corrected in tomcat5:

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0
through 4.1.36 does not properly handle (1) double quote (") characters
or (2) \%5C (encoded backslash) sequences in a cookie value, which
might cause sensitive information such as session IDs to be leaked
to remote attackers and enable session hijacking attacks. NOTE:
this issue exists because of an incomplete fix for CVE-2007-3385
(CVE-2007-5333).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through
6.0.18, and possibly earlier versions normalizes the target pathname
before filtering the query string when using the RequestDispatcher
method, which allows remote attackers to bypass intended access
restrictions and conduct directory traversal attacks via .. (dot dot)
sequences and the WEB-INF directory in a Request (CVE-2008-5515).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0
through 6.0.18, when the Java AJP connector and mod_jk load balancing
are used, allows remote attackers to cause a denial of service
(application outage) via a crafted request with invalid headers,
related to temporary blocking of connectors that have encountered
errors, as demonstrated by an error involving a malformed HTTP Host
header (CVE-2009-0033).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and
6.0.0 through 6.0.18, when FORM authentication is used, allows
remote attackers to enumerate valid usernames via requests to
/j_security_check with malformed URL encoding of passwords, related to
improper error checking in the (1) MemoryRealm, (2) DataSourceRealm,
and (3) JDBCRealm authentication realms, as demonstrated by a \%
(percent) value for the j_password parameter (CVE-2009-0580).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0
through 6.0.18 permits web applications to replace an XML parser used
for other web applications, which allows local users to read or modify
the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web
applications via a crafted application that is loaded earlier than
the target application (CVE-2009-0783).

Directory traversal vulnerability in Apache Tomcat 5.5.0 through
5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or
overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file,
as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693).

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and
6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase
files that remain from a failed undeploy, which might allow remote
attackers to bypass intended authentication requirements via HTTP
requests (CVE-2009-2901).

Directory traversal vulnerability in Apache Tomcat 5.5.0 through
5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete
work-directory files via directory traversal sequences in a WAR
filename, as demonstrated by the ...war filename (CVE-2009-2902).

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might
allow remote attackers to discover the server's hostname or IP
address by sending a request for a resource that requires (1) BASIC or
(2) DIGEST authentication, and then reading the realm field in the
WWW-Authenticate header in the reply (CVE-2010-1157).

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0
beta does not properly handle an invalid Transfer-Encoding header,
which allows remote attackers to cause a denial of service (application
outage) or obtain sensitive information via a crafted header that
interferes with recycling of a buffer. (CVE-2010-2227)

Packages for 2008.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.

Aktualisierte Pakete

2008.0 i586

 b7ec529ef67655e138bb9845381dafe0  2008.0/i586/tomcat5-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 7480f62988c594c5e963968a5d8a760c  2008.0/i586/tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 81f00d0be9c8fad809640b83015fd73e  2008.0/i586/tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 5e2b03d332177ca8f1b59b672e568028  2008.0/i586/tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 fd942acf4a4b56c678cf8dc46b3cf23b  2008.0/i586/tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 482cfd3a9f47ccfc8ed33e29918bd131  2008.0/i586/tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 97a9df65785526f25233c22c1c077eab  2008.0/i586/tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 cb9a2042c893f1818bef3fdec427da8b  2008.0/i586/tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 41e632f8c33e4c0d0d8106fbd4b1448f  2008.0/i586/tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 9c9ae10e58d6cf12b64400d3ba3c8895  2008.0/i586/tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
 9967a35bf6a073e8a8509da3c5a42559  2008.0/i586/tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm 
 723023ef6f65aee545713e42809d5b86  2008.0/SRPMS/tomcat5-5.5.23-9.2.10.3mdv2008.0.src.rpm

2008.0 x86_64

 4b424c91fb912dc8d58ecfaf887a730c  2008.0/x86_64/tomcat5-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 ca5003fcc1480d072729f2e3a01f374c  2008.0/x86_64/tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 83c84b3c3543e561be43c439931432e5  2008.0/x86_64/tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 e2a2adee1147b24791cdbc9612bbf812  2008.0/x86_64/tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 a31a7de061b6d692924e2be3b3ee2a9c  2008.0/x86_64/tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 42dff6a2eecaeb735dae70ffa28bfd83  2008.0/x86_64/tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 31da50a7f741eee25f7d3920ece1531c  2008.0/x86_64/tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 1670728be5615301bb60b2b01b993a1e  2008.0/x86_64/tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 ee4c0935479f16f258c78ba2c5225e84  2008.0/x86_64/tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 3383de2b3f2953ee01020d9b502900b3  2008.0/x86_64/tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
 b4fcecfae58187c2e0f644f569969ca6  2008.0/x86_64/tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm 
 723023ef6f65aee545713e42809d5b86  2008.0/SRPMS/tomcat5-5.5.23-9.2.10.3mdv2008.0.src.rpm

Referenzen