Synopsis

Moderate: Red Hat JBoss Web Server 2.0.1 tomcat7 security update

Type/Severity

Security Advisory: Moderate

Topic

Updated tomcat7 packages that fix three security issues are now available
for Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

It was found that when Tomcat processed a series of HTTP requests in which
at least one request contained either multiple content-length headers, or
one content-length header with a chunked transfer-encoding header, Tomcat
would incorrectly handle the request. A remote attacker could use this flaw
to poison a web cache, perform cross-site scripting (XSS) attacks, or
obtain sensitive information from other requests. (CVE-2013-4286)

It was discovered that the fix for CVE-2012-3544 did not properly resolve a
denial of service flaw in the way Tomcat processed chunk extensions and
trailing headers in chunked requests. A remote attacker could use this flaw
to send an excessively long request that, when processed by Tomcat, could
consume network bandwidth, CPU, and memory on the Tomcat server. Note that
chunked transfer encoding is enabled by default. (CVE-2013-4322)

A denial of service flaw was found in the way Apache Commons FileUpload,
which is embedded in Tomcat, handled small-sized buffers used by
MultipartStream. A remote attacker could use this flaw to create a
malformed Content-Type header for a multipart request, causing Tomcat to
enter an infinite loop when processing such an incoming request.
(CVE-2014-0050)

All users of Red Hat JBoss Web Server 2.0.1 are advised to upgrade to these
updated tomcat7 packages, which contain backported patches to correct these
issues. The Red Hat JBoss Web Server process must be restarted for the
update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied, and back up your existing Red
Hat JBoss Web Server installation (including all applications and
configuration files).

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Web Server 2 for RHEL 6 x86_64
• JBoss Enterprise Web Server 2 for RHEL 6 i386
• JBoss Enterprise Web Server 2 for RHEL 5 x86_64
• JBoss Enterprise Web Server 2 for RHEL 5 i386

Fixes

• BZ - 1062337 - CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
• BZ - 1069905 - CVE-2013-4322 tomcat: incomplete fix for CVE-2012-3544
• BZ - 1069921 - CVE-2013-4286 tomcat: multiple content-length header poisoning flaws

CVEs

• CVE-2013-4286
• CVE-2013-4322
• CVE-2014-0050

References

• https://access.redhat.com/security/updates/classification/#moderate

JBoss Enterprise Web Server 2 for RHEL 6

SRPM
tomcat7-7.0.40-9_patch_02.ep6.el6.src.rpm	SHA-256: 7eae405b8db23587305c3210ad433ce32db6670935fe7869b2328d0b4ba945f9
x86_64
tomcat7-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: bd27291a2a132432cf20bed499ea8dddad8cc714d86e9a17d256f79ae184b31e
tomcat7-admin-webapps-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 817f916aa3a3c5031922ee0a779282d94bb567203ffff5706664a051ea45db4d
tomcat7-docs-webapp-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: b98c0669caa51eb75fad25f127419beb62a2b004e06a5d9e97c103d25c738449
tomcat7-el-2.2-api-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 33e527de4c624a18c0ba8b028f16e554ede85ab18431c767d01882c1e6c9eb24
tomcat7-javadoc-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 8f3ed988416d4a145ba5b3759b5adfc843c6ff2c591eeb6c94116ca1d25b410b
tomcat7-jsp-2.2-api-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: a16e4e9d59bb09add8cb535cadb3c41e8f03ecf668ababc51313d6deca581e9c
tomcat7-lib-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: c68ca3d088194413595b659199b83f17b4f679045328c22ab0f9ae371b9365d9
tomcat7-log4j-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: f72195d691300e6c41fe270515f9d9f28e391182eb620ecc6e93a573e161f6bc
tomcat7-servlet-3.0-api-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: ae1939b6f542da3240ee560da1ddddafd0c6faf8f7fff132825d753a323cb522
tomcat7-webapps-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 4b5a2f25de577bec8003961ae9ad3216fe1775c9e6fddf753b16a3d00ee2351c
i386
tomcat7-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: bd27291a2a132432cf20bed499ea8dddad8cc714d86e9a17d256f79ae184b31e
tomcat7-admin-webapps-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 817f916aa3a3c5031922ee0a779282d94bb567203ffff5706664a051ea45db4d
tomcat7-docs-webapp-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: b98c0669caa51eb75fad25f127419beb62a2b004e06a5d9e97c103d25c738449
tomcat7-el-2.2-api-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 33e527de4c624a18c0ba8b028f16e554ede85ab18431c767d01882c1e6c9eb24
tomcat7-javadoc-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 8f3ed988416d4a145ba5b3759b5adfc843c6ff2c591eeb6c94116ca1d25b410b
tomcat7-jsp-2.2-api-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: a16e4e9d59bb09add8cb535cadb3c41e8f03ecf668ababc51313d6deca581e9c
tomcat7-lib-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: c68ca3d088194413595b659199b83f17b4f679045328c22ab0f9ae371b9365d9
tomcat7-log4j-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: f72195d691300e6c41fe270515f9d9f28e391182eb620ecc6e93a573e161f6bc
tomcat7-servlet-3.0-api-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: ae1939b6f542da3240ee560da1ddddafd0c6faf8f7fff132825d753a323cb522
tomcat7-webapps-7.0.40-9_patch_02.ep6.el6.noarch.rpm	SHA-256: 4b5a2f25de577bec8003961ae9ad3216fe1775c9e6fddf753b16a3d00ee2351c

JBoss Enterprise Web Server 2 for RHEL 5

SRPM
tomcat7-7.0.40-13_patch_02.ep6.el5.src.rpm	SHA-256: 51beee717f605d59a28de5726fd4730d2d75cd7788552a422f447fe73ba7e599
x86_64
tomcat7-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: fadba8d391077c11b2089d294279b503fbc6b156c608656a996b6880c407dc34
tomcat7-admin-webapps-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: de18b41526dba974673846551e6a5ea08aead774cab1885eaa5b32c1212be862
tomcat7-docs-webapp-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: e7360fcbf75d741581ea7a35646474fd635076e74cb4534a6cc0061888ac09b7
tomcat7-el-2.2-api-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 493b12e0516127cc9b77632e0529e0cc17a1de2a0cdd8779618d76970808ac9d
tomcat7-javadoc-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: cbef053811073e6493832d1fb5ce020521921eb9e38d7ecc3a0f76acfab48965
tomcat7-jsp-2.2-api-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 7ccfe2ce00d7aff905e6c82ef336c236ab5198abd3153ee52d83853925d93405
tomcat7-lib-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 52d481be23ef8ec34e19ec9b270599e1297f7b763253ca23178bef07397528e8
tomcat7-log4j-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 54e5768b136d74492e61d078bc36922160d4b902ed93cc8dd9050c6401938164
tomcat7-servlet-3.0-api-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 0b9cbd0bb405abea18bfc340ee01a366c43b0d513cbe7ee4c900202850a87f7c
tomcat7-webapps-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 72d2d0d7c15e66397b576e99d3cf1b23707fa6a73296fe0034736df39127bb6f
i386
tomcat7-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: fadba8d391077c11b2089d294279b503fbc6b156c608656a996b6880c407dc34
tomcat7-admin-webapps-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: de18b41526dba974673846551e6a5ea08aead774cab1885eaa5b32c1212be862
tomcat7-docs-webapp-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: e7360fcbf75d741581ea7a35646474fd635076e74cb4534a6cc0061888ac09b7
tomcat7-el-2.2-api-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 493b12e0516127cc9b77632e0529e0cc17a1de2a0cdd8779618d76970808ac9d
tomcat7-javadoc-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: cbef053811073e6493832d1fb5ce020521921eb9e38d7ecc3a0f76acfab48965
tomcat7-jsp-2.2-api-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 7ccfe2ce00d7aff905e6c82ef336c236ab5198abd3153ee52d83853925d93405
tomcat7-lib-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 52d481be23ef8ec34e19ec9b270599e1297f7b763253ca23178bef07397528e8
tomcat7-log4j-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 54e5768b136d74492e61d078bc36922160d4b902ed93cc8dd9050c6401938164
tomcat7-servlet-3.0-api-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 0b9cbd0bb405abea18bfc340ee01a366c43b0d513cbe7ee4c900202850a87f7c
tomcat7-webapps-7.0.40-13_patch_02.ep6.el5.noarch.rpm	SHA-256: 72d2d0d7c15e66397b576e99d3cf1b23707fa6a73296fe0034736df39127bb6f