Issued:
2016-11-17
Updated:
2016-11-17

RHSA-2016:2807 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.

Security Fix(es):

  • A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
  • It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
  • A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
  • A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
  • A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
  • It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)

Solution

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 2 for RHEL 7 x86_64
  • JBoss Enterprise Web Server 2 for RHEL 6 x86_64
  • JBoss Enterprise Web Server 2 for RHEL 6 i386

Fixes

  • BZ - 1311076 - CVE-2015-5351 tomcat: CSRF token leak
  • BZ - 1311082 - CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
  • BZ - 1311085 - CVE-2015-5346 tomcat: Session fixation
  • BZ - 1311087 - CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
  • BZ - 1311093 - CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
  • BZ - 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

CVEs

References

JBoss Enterprise Web Server 2 for RHEL 7

SRPM
tomcat7-7.0.54-23_patch_05.ep6.el7.src.rpm SHA-256: 1edad745c0043717a8c6581a9258b9d3c995c662d0953a125e28cc84a9bdb179
x86_64
tomcat7-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: e3717d138e7bb946d671cedcc594431783bb7fb377912764d5eb81dad2ae2216
tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: 925cab8be71b88e6883ab3e12fe2dd40659924ee40039fc6a96840b41d688059
tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: dd1569ad00fa9d931914fee96dc19f24f098f79b54d30ae6c01d23e6852fc18f
tomcat7-el-2.2-api-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: 85a2671f748b1c039eb898d51372a36f0aefa219431267b6d6a9f88894e34dbd
tomcat7-javadoc-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: 505a4a543f4a817b183fc4f7ce39ce0e7fb8a7c2b7770b767ada95a265a33b9a
tomcat7-jsp-2.2-api-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: bce56bf00a2fb29dc1039f354e11c11036b5d3fd266c4b8a5dcdc4dfe175491c
tomcat7-lib-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: cc1a64fb5902775f6d01fa40c44bf223575608a586fa57fceed871e541d3f222
tomcat7-log4j-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: e35d0054b4d59133c3adbc6cbe970c18eb6f5a69e80f628e609f4897b6c1ec6b
tomcat7-maven-devel-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: f3407b0d52cb2cfa887f0b6d28dedd633f90bfa6eeb7fbabea4322d7b555901d
tomcat7-servlet-3.0-api-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: d8c13c3b53f35d149ba97af8ec9f61d7dd8129f1067f40dc8faf9fe182f2466c
tomcat7-webapps-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: f902164df4628c104a6e2d33daa35bf1370412de21dc9f5aa31bd843e404bdf7

JBoss Enterprise Web Server 2 for RHEL 6

SRPM
tomcat7-7.0.54-23_patch_05.ep6.el6.src.rpm SHA-256: c0e3e66ba11ecd2204f4612548fe1b00abe8f2049fecca4e594841ce445e86cc
x86_64
tomcat7-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 91dece641d64b97085722bdd738dece9da95367c7b2c385cfdcd94384831e872
tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5ac04a420f277df602a1d08b117827f16d7db8fc1261dc992099e7b397ab5ef6
tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 04d35b58186c60b62bab9124d7234dcdbac50458e904187ce6293a334c228551
tomcat7-el-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5718f9109a6d7e5e2ddbaaeade9e410a935ff065e461f9202c12a238b1e41de6
tomcat7-javadoc-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 23764d283a1a3b235a41845aa9fcd9f0642c604ea8715828e61e676ccc070416
tomcat7-jsp-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 98385e1bf436c2555ffb0cce8617c623d7a43881f549f8b80c6276323ecb689a
tomcat7-lib-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8e5f9bf37e91e116c31c12b72d74e9b99643feadb9d662e7322bd13d48bebcdb
tomcat7-log4j-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 00731baeba3eb0819302068c453552492916ff0d36f478c98336cbe05232ae5f
tomcat7-maven-devel-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: caea84bbf24812dcc8e48a7ac8f63cfa4f262bb7b461314ca191e8a1bd251cd0
tomcat7-servlet-3.0-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8729b4c7cb3c2f8dee4f79dea389843ee9a87785e11b9a7b91ed121f08eb4c7a
tomcat7-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: b121b561ffc4ee44f5f8e1dd1a01a564c377a4a567411bac933c316aab8f51bb
i386
tomcat7-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 91dece641d64b97085722bdd738dece9da95367c7b2c385cfdcd94384831e872
tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5ac04a420f277df602a1d08b117827f16d7db8fc1261dc992099e7b397ab5ef6
tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 04d35b58186c60b62bab9124d7234dcdbac50458e904187ce6293a334c228551
tomcat7-el-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5718f9109a6d7e5e2ddbaaeade9e410a935ff065e461f9202c12a238b1e41de6
tomcat7-javadoc-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 23764d283a1a3b235a41845aa9fcd9f0642c604ea8715828e61e676ccc070416
tomcat7-jsp-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 98385e1bf436c2555ffb0cce8617c623d7a43881f549f8b80c6276323ecb689a
tomcat7-lib-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8e5f9bf37e91e116c31c12b72d74e9b99643feadb9d662e7322bd13d48bebcdb
tomcat7-log4j-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 00731baeba3eb0819302068c453552492916ff0d36f478c98336cbe05232ae5f
tomcat7-maven-devel-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: caea84bbf24812dcc8e48a7ac8f63cfa4f262bb7b461314ca191e8a1bd251cd0
tomcat7-servlet-3.0-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8729b4c7cb3c2f8dee4f79dea389843ee9a87785e11b9a7b91ed121f08eb4c7a
tomcat7-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: b121b561ffc4ee44f5f8e1dd1a01a564c377a4a567411bac933c316aab8f51bb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.