RHSA-2011:0897 - Security Advisory

Topic

JBoss Enterprise Web Server 1.0.2 is now available for Red Hat Enterprise
Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

JBoss Enterprise Web Server is a fully-integrated and certified set of
components for hosting Java web applications.

This is the first release of JBoss Enterprise Web Server for Red Hat
Enterprise Linux 6. For Red Hat Enterprise Linux 4 and 5, this release
serves as a replacement for JBoss Enterprise Web Server 1.0.1, and includes
a number of bug fixes. Refer to the Release Notes, linked in the
References, for more information.

This update corrects security flaws in the following components:

tomcat6:

A cross-site scripting (XSS) flaw was found in the Manager application,
used for managing web applications on Apache Tomcat. If a remote attacker
could trick a user who is logged into the Manager application into visiting
a specially-crafted URL, the attacker could perform Manager application
tasks with the privileges of the logged in user. (CVE-2010-4172)

tomcat5 and tomcat6:

It was found that web applications could modify the location of the Apache
Tomcat host's work directory. As web applications deployed on Tomcat have
read and write access to this directory, a malicious web application could
use this flaw to trick Tomcat into giving it read and write access to an
arbitrary directory on the file system. (CVE-2010-3718)

A second cross-site scripting (XSS) flaw was found in the Manager
application. A malicious web application could use this flaw to conduct an
XSS attack, leading to arbitrary web script execution with the privileges
of victims who are logged into and viewing Manager application web pages.
(CVE-2011-0013)

A possible minor information leak was found in the way Apache Tomcat
generated HTTP BASIC and DIGEST authentication requests. For configurations
where a realm name was not specified and Tomcat was accessed via a proxy,
the default generated realm contained the hostname and port used by the
proxy to send requests to the Tomcat server. (CVE-2010-1157)

httpd:

A flaw was found in the way the mod_dav module of the Apache HTTP Server
handled certain requests. If a remote attacker were to send a carefully
crafted request to the server, it could cause the httpd child process to
crash. (CVE-2010-1452)

apr:

It was found that the apr_fnmatch() function used an unconstrained
recursion when processing patterns with the '*' wildcard. An attacker could
use this flaw to cause an application using this function, which also
accepted untrusted input as a pattern for matching (such as an httpd server
using the mod_autoindex module), to exhaust all stack memory or use an
excessive amount of CPU time when performing matching. (CVE-2011-0419)

apr-util:

It was found that certain input could cause the apr-util library to
allocate more memory than intended in the apr_brigade_split_line()
function. An attacker able to provide input in small chunks to an
application using the apr-util library (such as httpd) could possibly use
this flaw to trigger high memory consumption. Note: This issue only
affected the JBoss Enterprise Web Server packages on Red Hat Enterprise
Linux 4. (CVE-2010-1623)

All users of JBoss Enterprise Web Server 1.0.1 are advised to upgrade to
JBoss Enterprise Web Server 1.0.2, which corrects these issues. After
installing this update, the relevant Apache Tomcat service ("tomcat5" or
"tomcat6") and the Apache HTTP Server ("httpd") must be restarted for the
update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• JBoss Enterprise Web Server 1 for RHEL 6 x86_64
• JBoss Enterprise Web Server 1 for RHEL 6 i386
• JBoss Enterprise Web Server 1 for RHEL 5 x86_64
• JBoss Enterprise Web Server 1 for RHEL 5 i386

Fixes

• BZ - 585331 - CVE-2010-1157 tomcat: information disclosure in authentication headers
• BZ - 618189 - CVE-2010-1452 httpd mod_cache, mod_dav: DoS (httpd child process crash) by parsing URI structure with missing path segments
• BZ - 640281 - CVE-2010-1623 apr-util: high memory consumption in apr_brigade_split_line()
• BZ - 656246 - CVE-2010-4172 tomcat: cross-site-scripting vulnerability in the manager application
• BZ - 675786 - CVE-2011-0013 tomcat: XSS vulnerability in HTML Manager interface
• BZ - 675792 - CVE-2010-3718 tomcat: file permission bypass flaw
• BZ - 677655 - JBEWS 1.0.2 release tracker bug for RHEL 4
• BZ - 677657 - JBEWS 1.0.2 release tracker bug for RHEL-5
• BZ - 677659 - JBEWS 1.0.2 release tracker bug for RHEL-6
• BZ - 703390 - CVE-2011-0419 apr: unconstrained recursion in apr_fnmatch

CVEs

• CVE-2010-1157
• CVE-2010-1452
• CVE-2010-1623
• CVE-2011-0419
• CVE-2010-3718
• CVE-2011-0013
• CVE-2010-4172
• CVE-2012-4557

References

• https://access.redhat.com/security/updates/classification/#moderate
• http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Web_Server/1.0/html-single/Release_Notes_1.0.2/index.html