Synopsis

Important: tomcat5 security update

Type/Severity

Security Advisory: Important

Topic

Updated tomcat5 packages that fix one security issue are now available for
JBoss Enterprise Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

Apache Tomcat is a servlet container.

It was found that when an application used FORM authentication, along with
another component that calls request.setUserPrincipal() before the call to
FormAuthenticator#authenticate() (such as the Single-Sign-On valve), it was
possible to bypass the security constraint checks in the FORM authenticator
by appending "/j_security_check" to the end of a URL. A remote attacker
with an authenticated session on an affected application could use this
flaw to circumvent authorization controls, and thereby access resources not
permitted by the roles associated with their authenticated session.
(CVE-2012-3546)

Warning: Before applying the update, back up your existing JBoss Enterprise
Web Server installation (including all applications and configuration
files).

Users of Tomcat should upgrade to these updated packages, which resolve
this issue. Tomcat must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Web Server 1 for RHEL 6 x86_64
• JBoss Enterprise Web Server 1 for RHEL 6 i386
• JBoss Enterprise Web Server 1 for RHEL 5 x86_64
• JBoss Enterprise Web Server 1 for RHEL 5 i386

Fixes

• BZ - 883634 - CVE-2012-3546 Tomcat/JBoss Web: Bypass of security constraints

CVEs

• CVE-2012-3546

References

• https://access.redhat.com/security/updates/classification/#important

JBoss Enterprise Web Server 1 for RHEL 6

SRPM
tomcat5-5.5.33-34_patch_08.ep5.el6.src.rpm	SHA-256: a9520340296278ad8cd60d4cfac88eb9a3af9fe3896b81fc3e9fb34eed2eb0cf
x86_64
tomcat5-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 58ad68f660d51b6e52a55fde342914232c6b21b4718e20abd1ec45235959dc3a
tomcat5-admin-webapps-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: ef457d2a14343aa85e5917bd2c48059fbf69c537d507eee06c37ab0d3eaf9274
tomcat5-common-lib-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: c3711609cf325e0b9c73057c3695a14ecf2b045660c50d6ee7837436be9d55b6
tomcat5-jasper-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 0f08bd86903a4dd3682581b9f9a8c87e647340d54a37c4fd7d4974da3e19fb0a
tomcat5-jasper-eclipse-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: fa536f2b4ed6244184cfbecd3a8704d65436bce95a6d59b7fe49f74c85508475
tomcat5-jasper-javadoc-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 7e6b9e512b480fb1d06e2c25b991a4984fc64066dda91e637aa422ce7386fa48
tomcat5-jsp-2.0-api-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 579dfd95e36e19ecb4c4a20792db8e224c52b23176bcc7134048fc3f77dc9e1e
tomcat5-jsp-2.0-api-javadoc-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 3f296559d553497f5a4c17c4811cd040db2779e7f9c1467013d0fc64ffa0a57a
tomcat5-parent-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 67973a4e739e2fe578dda0519e42049136190f7fd64ada0d318019962dabd7d6
tomcat5-server-lib-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 25d7d0403801a41d0ebb61aae77187504c8bb663572fd126a64efdd52dbcb6dc
tomcat5-servlet-2.4-api-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 682467a643f058a63334a461b783463096fc886063232b9920872b92327cf1d6
tomcat5-servlet-2.4-api-javadoc-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 9859c02ea6a90f1254976c5b4d303f9d9f738a28cf5e231d5ac14158a1e073f9
tomcat5-webapps-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 8a9aeefb4122bd08921d6e7105eb00f2be1a79f64a7a32f3b4d118bfd27c747c
i386
tomcat5-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 58ad68f660d51b6e52a55fde342914232c6b21b4718e20abd1ec45235959dc3a
tomcat5-admin-webapps-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: ef457d2a14343aa85e5917bd2c48059fbf69c537d507eee06c37ab0d3eaf9274
tomcat5-common-lib-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: c3711609cf325e0b9c73057c3695a14ecf2b045660c50d6ee7837436be9d55b6
tomcat5-jasper-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 0f08bd86903a4dd3682581b9f9a8c87e647340d54a37c4fd7d4974da3e19fb0a
tomcat5-jasper-eclipse-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: fa536f2b4ed6244184cfbecd3a8704d65436bce95a6d59b7fe49f74c85508475
tomcat5-jasper-javadoc-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 7e6b9e512b480fb1d06e2c25b991a4984fc64066dda91e637aa422ce7386fa48
tomcat5-jsp-2.0-api-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 579dfd95e36e19ecb4c4a20792db8e224c52b23176bcc7134048fc3f77dc9e1e
tomcat5-jsp-2.0-api-javadoc-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 3f296559d553497f5a4c17c4811cd040db2779e7f9c1467013d0fc64ffa0a57a
tomcat5-parent-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 67973a4e739e2fe578dda0519e42049136190f7fd64ada0d318019962dabd7d6
tomcat5-server-lib-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 25d7d0403801a41d0ebb61aae77187504c8bb663572fd126a64efdd52dbcb6dc
tomcat5-servlet-2.4-api-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 682467a643f058a63334a461b783463096fc886063232b9920872b92327cf1d6
tomcat5-servlet-2.4-api-javadoc-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 9859c02ea6a90f1254976c5b4d303f9d9f738a28cf5e231d5ac14158a1e073f9
tomcat5-webapps-5.5.33-34_patch_08.ep5.el6.noarch.rpm	SHA-256: 8a9aeefb4122bd08921d6e7105eb00f2be1a79f64a7a32f3b4d118bfd27c747c

JBoss Enterprise Web Server 1 for RHEL 5

SRPM
tomcat5-5.5.33-31_patch_08.ep5.el5.src.rpm	SHA-256: e2912d4b5363b4933c24551b712347ffb59c104d8d80704879e00fa2dfedef99
x86_64
tomcat5-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: c2be5d4dfa4eb93d6d35260e707feaae8f1b07a4ce3a6eeb0955ff5493b526e6
tomcat5-admin-webapps-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: aab9f75477da64f03594fcdda223ef6f1da15d7fa9e9e5f9f548917f4326274f
tomcat5-common-lib-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 7ff2235089fdf1a711fbda88cd8019c8317fcecff8e9818429f46e3b0b2b5f22
tomcat5-jasper-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 0a232c52d1e19b24411d6749a25a8c847f4fc0073f847a0131e28f4f742707cd
tomcat5-jasper-eclipse-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: eb4c90e0ad9c95481d541a7b8ba0eb2658b1091508fef8f2874a7b7a9e5fcc3b
tomcat5-jasper-javadoc-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: c857d6322bd70c0225ebe8c1f16c220c300c66eee08bfd5ccb3f7056c5f70d8c
tomcat5-jsp-2.0-api-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: ae5e5534eb5753a168cf718e8c93d60709deb29b68901538bb97c4455e1573fc
tomcat5-jsp-2.0-api-javadoc-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: eff6923ab379cccc9fc09d27fcd42059fef8e809f8d5e0c875328456a7db4fe7
tomcat5-parent-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 54d5044c3588639d42fde4c3e805320fa09df79595bbedc1dc89355fb221314b
tomcat5-server-lib-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 32f695ff69d7825b47bcc3f7bba692e8fd14ee3415da58a3925dc336a099e35a
tomcat5-servlet-2.4-api-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: be8e1c5d7ab70b37d24df8d7c4ae92754c2f7105d2b470300effafa6f94315d2
tomcat5-servlet-2.4-api-javadoc-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 314a8e27181c6edb4ebdd9561586868533764a1b607b40b6b53cdd0ed465b019
tomcat5-webapps-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: e5307209fbdcb93b56499bc6a1194c3e03e95e9a485d0ee7e5d6cb4d0a4f5747
i386
tomcat5-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: c2be5d4dfa4eb93d6d35260e707feaae8f1b07a4ce3a6eeb0955ff5493b526e6
tomcat5-admin-webapps-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: aab9f75477da64f03594fcdda223ef6f1da15d7fa9e9e5f9f548917f4326274f
tomcat5-common-lib-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 7ff2235089fdf1a711fbda88cd8019c8317fcecff8e9818429f46e3b0b2b5f22
tomcat5-jasper-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 0a232c52d1e19b24411d6749a25a8c847f4fc0073f847a0131e28f4f742707cd
tomcat5-jasper-eclipse-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: eb4c90e0ad9c95481d541a7b8ba0eb2658b1091508fef8f2874a7b7a9e5fcc3b
tomcat5-jasper-javadoc-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: c857d6322bd70c0225ebe8c1f16c220c300c66eee08bfd5ccb3f7056c5f70d8c
tomcat5-jsp-2.0-api-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: ae5e5534eb5753a168cf718e8c93d60709deb29b68901538bb97c4455e1573fc
tomcat5-jsp-2.0-api-javadoc-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: eff6923ab379cccc9fc09d27fcd42059fef8e809f8d5e0c875328456a7db4fe7
tomcat5-parent-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 54d5044c3588639d42fde4c3e805320fa09df79595bbedc1dc89355fb221314b
tomcat5-server-lib-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 32f695ff69d7825b47bcc3f7bba692e8fd14ee3415da58a3925dc336a099e35a
tomcat5-servlet-2.4-api-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: be8e1c5d7ab70b37d24df8d7c4ae92754c2f7105d2b470300effafa6f94315d2
tomcat5-servlet-2.4-api-javadoc-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: 314a8e27181c6edb4ebdd9561586868533764a1b607b40b6b53cdd0ed465b019
tomcat5-webapps-5.5.33-31_patch_08.ep5.el5.noarch.rpm	SHA-256: e5307209fbdcb93b56499bc6a1194c3e03e95e9a485d0ee7e5d6cb4d0a4f5747