RHSA-2012:0682 - Security Advisory

Topic

Updated tomcat6 packages that fix multiple security issues and three bugs
are now available for JBoss Enterprise Web Server 1.0.2 for Red Hat
Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Apache Tomcat is a servlet container.

JBoss Enterprise Web Server includes the Tomcat Native library, providing
Apache Portable Runtime (APR) support for Tomcat. References in this text
to APR refer to the Tomcat Native implementation, not any other apr
package.

This update fixes the JBPAPP-4873, JBPAPP-6133, and JBPAPP-6852 bugs. It
also resolves the following security issues:

Multiple flaws weakened the Tomcat HTTP DIGEST authentication
implementation, subjecting it to some of the weaknesses of HTTP BASIC
authentication, for example, allowing remote attackers to perform session
replay attacks. (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,
CVE-2011-5064)

A flaw was found in the way the Coyote (org.apache.coyote.ajp.AjpProcessor)
and APR (org.apache.coyote.ajp.AjpAprProcessor) Tomcat AJP (Apache JServ
Protocol) connectors processed certain POST requests. An attacker could
send a specially-crafted request that would cause the connector to treat
the message body as a new request. This allows arbitrary AJP messages to be
injected, possibly allowing an attacker to bypass a web application's
authentication checks and gain access to information they would otherwise
be unable to access. The JK (org.apache.jk.server.JkCoyoteHandler)
connector is used by default when the APR libraries are not present. The JK
connector is not affected by this flaw. (CVE-2011-3190)

A flaw in the way Tomcat recycled objects that contain data from user
requests (such as IP addresses and HTTP headers) when certain errors
occurred. If a user sent a request that caused an error to be logged,
Tomcat would return a reply to the next request (which could be sent by a
different user) with data from the first user's request, leading to
information disclosure. Under certain conditions, a remote attacker could
leverage this flaw to hijack sessions. (CVE-2011-3375)

The Java hashCode() method implementation was susceptible to predictable
hash collisions. A remote attacker could use this flaw to cause Tomcat to
use an excessive amount of CPU time by sending an HTTP request with a large
number of parameters whose names map to the same hash value. This update
introduces a limit on the number of parameters processed per request to
mitigate this issue. The default limit is 512 for parameters and 128 for
headers. These defaults can be changed by setting the
org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2011-4858)

Tomcat did not handle large numbers of parameters and large parameter
values efficiently. A remote attacker could make Tomcat use an excessive
amount of CPU time by sending an HTTP request containing a large number of
parameters or large parameter values. This update introduces limits on the
number of parameters and headers processed per request to address this
issue. Refer to the CVE-2011-4858 description for information about the
org.apache.tomcat.util.http.Parameters.MAX_COUNT and
org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.
(CVE-2012-0022)

A flaw in the Tomcat MemoryUserDatabase. If a runtime exception occurred
when creating a new user with a JMX client, that user's password was logged
to Tomcat log files. Note: By default, only administrators have access to
such log files. (CVE-2011-2204)

A flaw in the way Tomcat handled sendfile request attributes when using the
HTTP APR or NIO (Non-Blocking I/O) connector. A malicious web application
running on a Tomcat instance could use this flaw to bypass security manager
restrictions and gain access to files it would otherwise be unable to
access, or possibly terminate the Java Virtual Machine (JVM). The HTTP NIO
connector is used by default in JBoss Enterprise Web Server.
(CVE-2011-2526)

Red Hat would like to thank oCERT for reporting CVE-2011-4858, and the
Apache Tomcat project for reporting CVE-2011-2526. oCERT acknowledges
Julian Wälde and Alexander Klink as the original reporters of
CVE-2011-4858.

Solution

Users of Tomcat should upgrade to these updated packages, which
resolve these issues. Tomcat must be restarted for this update to take
effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Web Server 1 for RHEL 6 x86_64
• JBoss Enterprise Web Server 1 for RHEL 6 i386
• JBoss Enterprise Web Server 1 for RHEL 5 x86_64
• JBoss Enterprise Web Server 1 for RHEL 5 i386

Fixes

• BZ - 717013 - CVE-2011-2204 tomcat: password disclosure vulnerability
• BZ - 720948 - CVE-2011-2526 tomcat: security manager restrictions bypass
• BZ - 734868 - CVE-2011-3190 tomcat: authentication bypass and information disclosure
• BZ - 741401 - CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 tomcat: Multiple weaknesses in HTTP DIGEST authentication
• BZ - 750521 - CVE-2011-4858 tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)
• BZ - 782624 - CVE-2011-3375 tomcat: information disclosure due to improper response and request object recycling
• BZ - 783359 - CVE-2012-0022 tomcat: large number of parameters DoS

CVEs

• CVE-2011-2526
• CVE-2011-3190
• CVE-2011-1184
• CVE-2011-2204
• CVE-2011-5062
• CVE-2011-5063
• CVE-2011-5064
• CVE-2011-4858
• CVE-2012-0022
• CVE-2011-3375

References

• https://access.redhat.com/security/updates/classification/#moderate
• http://tomcat.apache.org/security-6.html
• https://issues.jboss.org/browse/JBPAPP-4873
• https://issues.jboss.org/browse/JBPAPP-6133
• https://issues.jboss.org/browse/JBPAPP-6852