概要

Important: tomcat security update

タイプ/重大度

Security Advisory: Important

トピック

Updated tomcat packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

説明

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

It was discovered that the Red Hat Security Advisory RHSA-2007:0871 did not
address all possible flaws in the way Tomcat handles certain characters and
character sequences in cookie values. A remote attacker could use this flaw
to obtain sensitive information, such as session IDs, and then use this
information for session hijacking attacks. (CVE-2007-5333)

Note: The fix for the CVE-2007-5333 flaw changes the default cookie
processing behavior: with this update, version 0 cookies that contain
values that must be quoted to be valid are automatically changed to version
1 cookies. To reactivate the previous, but insecure behavior, add the
following entry to the "/etc/tomcat5/catalina.properties" file:

org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false

It was discovered that request dispatchers did not properly normalize user
requests that have trailing query strings, allowing remote attackers to
send specially-crafted requests that would cause an information leak.
(CVE-2008-5515)

A flaw was found in the way the Tomcat AJP (Apache JServ Protocol)
connector processes AJP connections. An attacker could use this flaw to
send specially-crafted requests that would cause a temporary denial of
service. (CVE-2009-0033)

It was discovered that the error checking methods of certain authentication
classes did not have sufficient error checking, allowing remote attackers
to enumerate (via brute force methods) usernames registered with
applications running on Tomcat when FORM-based authentication was used.
(CVE-2009-0580)

A cross-site scripting (XSS) flaw was found in the examples calendar
application. With some web browsers, remote attackers could use this flaw
to inject arbitrary web script or HTML via the "time" parameter.
(CVE-2009-0781)

It was discovered that web applications containing their own XML parsers
could replace the XML parser Tomcat uses to parse configuration files. A
malicious web application running on a Tomcat instance could read or,
potentially, modify the configuration and XML-based data of other web
applications deployed on the same Tomcat instance. (CVE-2009-0783)

Users of Tomcat should upgrade to these updated packages, which contain
backported patches to resolve these issues. Tomcat must be restarted for
this update to take effect.

解決法

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

影響を受ける製品

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc

修正

• BZ - 427766 - CVE-2007-5333 Improve cookie parsing for tomcat5
• BZ - 489028 - CVE-2009-0781 tomcat: XSS in Apache Tomcat calendar application
• BZ - 493381 - CVE-2009-0033 tomcat6 Denial-Of-Service with AJP connection
• BZ - 503978 - CVE-2009-0580 tomcat6 Information disclosure in authentication classes
• BZ - 504153 - CVE-2009-0783 tomcat XML parser information disclosure
• BZ - 504753 - CVE-2008-5515 tomcat request dispatcher information disclosure vulnerability

CVE

• CVE-2008-5515
• CVE-2009-0783
• CVE-2009-0580
• CVE-2009-0033
• CVE-2007-5333
• CVE-2009-0781

参考資料

• http://tomcat.apache.org/security-5.html
• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
x86_64
tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: f0dc2157ef1c032d99d643bb6580cfe8549314dd97e5fe83cf87f7d549d7f099
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 5e5b892c451786608d995d0ae70daa93cc63e3d0d6e18a3171353dbf5dae3b78
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: f28b0c25dd1556ca712fef2bd232718a0806a4125099bd11cc6993d1ccf2d8ff
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 3b39da342789216bf492c7c3fc582702cc5a4d8c39b65d3753154371b4ed2238
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 446ee9e1bd42e6f02e2adfa4224c9b1ecebc7ba20ab0f6c99ac0e7db491d301a
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0e567fec78bb9f703fc55779a67381aa8f37ae867d11b26f1b229fd98cd686a9
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: c33e0da1d9b09b576c88c6b8dfa55ad7492685093ff940231edba9244c31f6ca
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: d08e100740aec70a406c64b9532fccccbefdcebd89154377b85a10b989d8a0a5
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0d5901664efc2491086586b00d05084350d3b3d3351a9a0bf79a507375750b57
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 1c89cc2060af4694eb904a15cb2f4653f6c5c0932b693790f3fe68a527c22f6a
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 59adcadf8cdbe6536c3bdf27323608973760232e094749ec7e26c8502617e07d

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: f0dc2157ef1c032d99d643bb6580cfe8549314dd97e5fe83cf87f7d549d7f099
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 5e5b892c451786608d995d0ae70daa93cc63e3d0d6e18a3171353dbf5dae3b78
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: f28b0c25dd1556ca712fef2bd232718a0806a4125099bd11cc6993d1ccf2d8ff
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 3b39da342789216bf492c7c3fc582702cc5a4d8c39b65d3753154371b4ed2238
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 446ee9e1bd42e6f02e2adfa4224c9b1ecebc7ba20ab0f6c99ac0e7db491d301a
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0e567fec78bb9f703fc55779a67381aa8f37ae867d11b26f1b229fd98cd686a9
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: c33e0da1d9b09b576c88c6b8dfa55ad7492685093ff940231edba9244c31f6ca
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: d08e100740aec70a406c64b9532fccccbefdcebd89154377b85a10b989d8a0a5
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0d5901664efc2491086586b00d05084350d3b3d3351a9a0bf79a507375750b57
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 1c89cc2060af4694eb904a15cb2f4653f6c5c0932b693790f3fe68a527c22f6a
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 59adcadf8cdbe6536c3bdf27323608973760232e094749ec7e26c8502617e07d

Red Hat Enterprise Linux Desktop 5

SRPM
x86_64
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0e567fec78bb9f703fc55779a67381aa8f37ae867d11b26f1b229fd98cd686a9
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0d5901664efc2491086586b00d05084350d3b3d3351a9a0bf79a507375750b57

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: f0dc2157ef1c032d99d643bb6580cfe8549314dd97e5fe83cf87f7d549d7f099
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 5e5b892c451786608d995d0ae70daa93cc63e3d0d6e18a3171353dbf5dae3b78
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: f28b0c25dd1556ca712fef2bd232718a0806a4125099bd11cc6993d1ccf2d8ff
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 3b39da342789216bf492c7c3fc582702cc5a4d8c39b65d3753154371b4ed2238
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 446ee9e1bd42e6f02e2adfa4224c9b1ecebc7ba20ab0f6c99ac0e7db491d301a
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0e567fec78bb9f703fc55779a67381aa8f37ae867d11b26f1b229fd98cd686a9
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: c33e0da1d9b09b576c88c6b8dfa55ad7492685093ff940231edba9244c31f6ca
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: d08e100740aec70a406c64b9532fccccbefdcebd89154377b85a10b989d8a0a5
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 0d5901664efc2491086586b00d05084350d3b3d3351a9a0bf79a507375750b57
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 1c89cc2060af4694eb904a15cb2f4653f6c5c0932b693790f3fe68a527c22f6a
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm	SHA-256: 59adcadf8cdbe6536c3bdf27323608973760232e094749ec7e26c8502617e07d