Synopsis

Important: tomcat6 security update

Type/Severity

Security Advisory: Important

Topic

Updated tomcat6 packages that fix two security issues are now available for
JBoss Enterprise Web Server 1.0.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

A denial of service flaw was found in the way certain strings were
converted to Double objects. A remote attacker could use this flaw to cause
Tomcat to hang via a specially-crafted HTTP request. (CVE-2010-4476)

A flaw was found in the Tomcat NIO (Non-Blocking I/O) connector. A remote
attacker could use this flaw to cause a denial of service (out-of-memory
condition) via a specially-crafted request containing a large NIO buffer
size request value. (CVE-2011-0534)

Users of Tomcat should upgrade to these updated packages, which contain
backported patches to correct these issues. Tomcat must be restarted for
this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• JBoss Enterprise Web Server 1 for RHEL 5 x86_64
• JBoss Enterprise Web Server 1 for RHEL 5 i386

Fixes

• BZ - 674336 - CVE-2010-4476 JDK Double.parseDouble Denial-Of-Service
• BZ - 675338 - CVE-2011-0534 tomcat: remote DoS via NIO connector

CVEs

• CVE-2010-4476
• CVE-2011-0534

References

• https://access.redhat.com/security/updates/classification/#important
• http://tomcat.apache.org/security-6.html

JBoss Enterprise Web Server 1 for RHEL 5

SRPM
tomcat6-6.0.24-11.patch_03.ep5.el5.src.rpm	SHA-256: c4cc525ee5ca45ca2c854398de33f6127f80fab3e43a5184dc878bcb440e6981
x86_64
tomcat6-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: e191491a3fe145ce0f9807262cf960678dff122be8e2fab528471328445cec53
tomcat6-admin-webapps-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: c8c86a76b0910aedd0cf22b77fa21badfbd77659781269c4083f4f1c1cb85f2d
tomcat6-docs-webapp-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 5e32cd483bbf22af591f1af2bbe4995c8b57527ffc3fe586ccda7b3037949b7f
tomcat6-el-1.0-api-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: f9dac689bd0ec05a499fc0852e561caecb8a64f89d830df4194d8ca156e3dd04
tomcat6-javadoc-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 139e5eaa40d7b1724da95358af7b4a5a6599144937098ccd8f46911b095aa455
tomcat6-jsp-2.1-api-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 0836a60dab0af4f8cd78357397f7026018fae479eec4c0090ccc1012da6d0dcd
tomcat6-lib-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: e00edb66d4f368c45b3379c512296bfc9ded7e72dc5b613b08996b3ef122230a
tomcat6-log4j-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 645a3b570382ce5acc115475ecdb619ff488e6560dc10e1f8869838b93e30087
tomcat6-servlet-2.5-api-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: cad14f424f44f78be7d98d654a91e60a464706b35ee3c28bd128f7d6e397f854
tomcat6-webapps-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 770eca685a137b45a974dc07cb96cd3cdf300e18c8ddba475705b56cdeb62f80
i386
tomcat6-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: e191491a3fe145ce0f9807262cf960678dff122be8e2fab528471328445cec53
tomcat6-admin-webapps-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: c8c86a76b0910aedd0cf22b77fa21badfbd77659781269c4083f4f1c1cb85f2d
tomcat6-docs-webapp-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 5e32cd483bbf22af591f1af2bbe4995c8b57527ffc3fe586ccda7b3037949b7f
tomcat6-el-1.0-api-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: f9dac689bd0ec05a499fc0852e561caecb8a64f89d830df4194d8ca156e3dd04
tomcat6-javadoc-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 139e5eaa40d7b1724da95358af7b4a5a6599144937098ccd8f46911b095aa455
tomcat6-jsp-2.1-api-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 0836a60dab0af4f8cd78357397f7026018fae479eec4c0090ccc1012da6d0dcd
tomcat6-lib-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: e00edb66d4f368c45b3379c512296bfc9ded7e72dc5b613b08996b3ef122230a
tomcat6-log4j-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 645a3b570382ce5acc115475ecdb619ff488e6560dc10e1f8869838b93e30087
tomcat6-servlet-2.5-api-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: cad14f424f44f78be7d98d654a91e60a464706b35ee3c28bd128f7d6e397f854
tomcat6-webapps-6.0.24-11.patch_03.ep5.el5.noarch.rpm	SHA-256: 770eca685a137b45a974dc07cb96cd3cdf300e18c8ddba475705b56cdeb62f80