Synopsis

Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat JBoss Web Server 3 for RHEL 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements.

Security Fix(es):

• It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. (CVE-2016-1240)
  
• It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)
  
• The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)
  
• A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
  
• It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)
  
• A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)
  
• The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)
  
• It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018)
  
• It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794)
  
• It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)
  
• It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797)
  

The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Enhancement(s):

This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 6. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-267)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

Solution

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• JBoss Enterprise Web Server 3 for RHEL 6 x86_64
• JBoss Enterprise Web Server 3 for RHEL 6 i386

Fixes

• BZ - 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service
• BZ - 1367447 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation
• BZ - 1376712 - CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation
• BZ - 1390493 - CVE-2016-6797 tomcat: unrestricted access to global resources
• BZ - 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters
• BZ - 1390520 - CVE-2016-6794 tomcat: system property disclosure
• BZ - 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function
• BZ - 1390526 - CVE-2016-0762 tomcat: timing attack in Realm implementation
• BZ - 1397484 - CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
• BZ - 1397485 - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
• BZ - 1403824 - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing

CVEs

• CVE-2016-0762
• CVE-2016-1240
• CVE-2016-3092
• CVE-2016-5018
• CVE-2016-6325
• CVE-2016-6794
• CVE-2016-6796
• CVE-2016-6797
• CVE-2016-6816
• CVE-2016-8735
• CVE-2016-8745

References

• https://access.redhat.com/security/updates/classification/#important

JBoss Enterprise Web Server 3 for RHEL 6

SRPM
hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.src.rpm	SHA-256: 9785354be46db0e2f53e78ac73e4b69d60e8bc59602682d65d96cfe07ed99f15
jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.src.rpm	SHA-256: 86c9407c07088245d9238fde1fdba3c9e784d5869fea3421ce5b1e960cd91515
jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.src.rpm	SHA-256: bd9c5fa64c22595b2bd4c8be983f406dad7c46298430d1ff304c67d34f14abf4
mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.src.rpm	SHA-256: c06955860b199f5468a523b2ca039b529728828e2a70d84478004b87983e934c
tomcat-native-1.2.8-9.redhat_9.ep7.el6.src.rpm	SHA-256: 64f26621131c8be40cdc747a251542829dd3ca6f9569557fc664577ae570b0e7
tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.src.rpm	SHA-256: 80ff724181914c27d18b88c90c147c2e7f8d316989dbbcf78d8218ea76002304
tomcat7-7.0.70-16.ep7.el6.src.rpm	SHA-256: b2f81af56278f591780c0476820a179497981362a04cd938302abe47ea78edb9
tomcat8-8.0.36-17.ep7.el6.src.rpm	SHA-256: bc5d05f340c8e6cc459c02f295c2a24f4c15ca218ad18a598e3fce757b63a355
x86_64
hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: e184a9132783cd7402d5eea9d6e0ea5fdf4cf0a418a6734b8ff3ee98382093c5
hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: 4d82554150ee970c5b1f175ebbc4e4966573564ea76ad1833f2bed5ad1ecc951
hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: a2623687e84de2b875f2e315712c5aaca25891212f259ed69d492ba5ce42a842
hibernate4-entitymanager-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: 70311c8b893db072c794a38176c48fa52bf0f725266c8de0ea2387fd76d23fad
hibernate4-envers-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: 2fb3522116d908daadf62205ad105e44c9f03cdb97a49c6e95dc44b241c2dc05
jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.noarch.rpm	SHA-256: 19da19a618267f7f5ebb9897ed4b3df34dd17d7be78978708a4124e748f5c33d
jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.x86_64.rpm	SHA-256: 62650d6bfc0ea1353d78488e1aa046825a84fe6e795361771f1b5f0c507f7ff9
jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.x86_64.rpm	SHA-256: abe898e56c523521f2afa13d08e86a8f3abbc934e73ecc7fa8345d459cf49c61
jbcs-httpd24-runtime-1-3.jbcs.el6.noarch.rpm	SHA-256: 8ac86a3df21bd84036eaeedcf6a780bc81d36b74924fc05a308cbb3fc0241865
mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: ec52a9de889daca60855bc064926f519ac6be9eccc145d6d5f7a3ad3bf67e478
mod_cluster-tomcat7-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 07f1c6428aaeeeb10545e5b0804fb96c52727887414a96731cdc658574acf70f
mod_cluster-tomcat8-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 720aae25f30086c71366cbac3ba83ce8202f385dd6a063cfe237ebd08a60735c
tomcat-native-1.2.8-9.redhat_9.ep7.el6.x86_64.rpm	SHA-256: 26ac11587d433fa00c6c3f9573c9ab47c27799768460f54d1d7a0668264dd98b
tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el6.x86_64.rpm	SHA-256: fa283f50e7ccafdee72c561feac6a251c7a33b8242ca8f29a88fd39a318eceff
tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: c5cb1cd0fec8b4987d07a455bb4d5696d4f299367e150aba961831e86792299f
tomcat7-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 5ff3139f43f85fbcdce9592fadcffe34a2b0666313c76624b3285f6fa5f2f854
tomcat7-admin-webapps-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 3bc1f405045258acaada8041d42a28eac9f75a019775583965bb30fff4c55306
tomcat7-docs-webapp-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: da56d8c84d80899221979f5fbbc6b5473001515d85d73ba39584664d86f92260
tomcat7-el-2.2-api-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 0bc48d86af972f77f4f0eb1a9be7d2bc2165353fb894d5acadff2a44cba61343
tomcat7-javadoc-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: c79a33db08921e7d556bf87ab8778fb9c47a2a7049f69839320ac8e111c5e0fc
tomcat7-jsp-2.2-api-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 6166b9576e7c6bd822e7a4c410279cb8634fd7ca9247bdd8584a195b06810d9a
tomcat7-jsvc-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 7da480ed4d118a6242660d6a05e03f60f8414d591b10be09ccae0ac8f1395be4
tomcat7-lib-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 14ad2ccd7fce5c619e4ebb505b5e38736efeec549ede9cadda4bba063358cb42
tomcat7-log4j-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 9a75819b8d1744964de849400576dba0b768e7402a37cacf010d22cdd334c7a5
tomcat7-selinux-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: dc033fe0cbf6c7dcc0c8914d3e449d61adf5504b9dd059e71ec04af5bb23f64a
tomcat7-servlet-3.0-api-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 664746487058fb9a199019f3ac7a9bf0082ca34b7d2168d081f1005f6e2e5a90
tomcat7-webapps-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: aafadeb114c66f52f78db40cc8a06f899324a323646adb25e217b54b5b4f2e14
tomcat8-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 2efc0e1eebd92c88a04d9cbadff97868b480e380b44cfcfc452107f39a4486cd
tomcat8-admin-webapps-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: ca8b983289f2b840a199167fe11293870fb299fde3bfcba65e01dba7540c2012
tomcat8-docs-webapp-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: f94e8a92591e678ef76a3c9ccef45313b4529a4c93b9c8c3c2361b8cb0e7e958
tomcat8-el-2.2-api-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 394b574eb1ca09ab54904497f855509c50c57bf1802fcd3b4f69ab001cfbac81
tomcat8-javadoc-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 11d627b5e5d594c4a95f2c0319d441d75044b4e5607f704f368cbb24db4fc91c
tomcat8-jsp-2.3-api-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 36276d484ddc63d554279df4da74fd44efb41442b11a6011b71771b999eadde3
tomcat8-jsvc-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 9f41a63b936c1df94137db967d811e4e0aa127a504dabd8b0eb6abcee5ca83ff
tomcat8-lib-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: b344a30bcb8cacf86c1ea5d869901d3bd562d0ea979ebb6f1deac88e0cdec368
tomcat8-log4j-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: c9793802dac6ebed64cd7ca216cc932eae94cd4aab23193645f8d7104c61bbd9
tomcat8-selinux-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 4fe091a25cb455951327512f511b01f1dc139d39c82f2fd8547bbd6b935a8493
tomcat8-servlet-3.1-api-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: eccdf89317b4648b109ffee273ae3726dcb2f858410edad5eaed47b78b71b4a6
tomcat8-webapps-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 8ab1ba0cb5f288ec76a81d579375d10ff86c1ac983cdc53e06079055881c80f9
i386
hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: e184a9132783cd7402d5eea9d6e0ea5fdf4cf0a418a6734b8ff3ee98382093c5
hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: 4d82554150ee970c5b1f175ebbc4e4966573564ea76ad1833f2bed5ad1ecc951
hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: a2623687e84de2b875f2e315712c5aaca25891212f259ed69d492ba5ce42a842
hibernate4-entitymanager-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: 70311c8b893db072c794a38176c48fa52bf0f725266c8de0ea2387fd76d23fad
hibernate4-envers-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm	SHA-256: 2fb3522116d908daadf62205ad105e44c9f03cdb97a49c6e95dc44b241c2dc05
jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.noarch.rpm	SHA-256: 19da19a618267f7f5ebb9897ed4b3df34dd17d7be78978708a4124e748f5c33d
jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.i686.rpm	SHA-256: 05b77778830c7fd6e5c3ca56609eef48f735e4efe826697116c1d5f1470f8a9d
jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.i686.rpm	SHA-256: 5483930472b1e82f7e700a5bf24a36f8d691be450fab1ef586f5bff5c8a520ee
jbcs-httpd24-runtime-1-3.jbcs.el6.noarch.rpm	SHA-256: 8ac86a3df21bd84036eaeedcf6a780bc81d36b74924fc05a308cbb3fc0241865
mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: ec52a9de889daca60855bc064926f519ac6be9eccc145d6d5f7a3ad3bf67e478
mod_cluster-tomcat7-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 07f1c6428aaeeeb10545e5b0804fb96c52727887414a96731cdc658574acf70f
mod_cluster-tomcat8-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 720aae25f30086c71366cbac3ba83ce8202f385dd6a063cfe237ebd08a60735c
tomcat-native-1.2.8-9.redhat_9.ep7.el6.i686.rpm	SHA-256: 4d7d00267f5053b671d836fafd08cb32c87b3aa53965ea0ecc72044fcded485e
tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el6.i686.rpm	SHA-256: efdae2b1ed5ce70c04aca9667404c264faef6734fd7fc27fdba136d60b8847df
tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.noarch.rpm	SHA-256: c5cb1cd0fec8b4987d07a455bb4d5696d4f299367e150aba961831e86792299f
tomcat7-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 5ff3139f43f85fbcdce9592fadcffe34a2b0666313c76624b3285f6fa5f2f854
tomcat7-admin-webapps-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 3bc1f405045258acaada8041d42a28eac9f75a019775583965bb30fff4c55306
tomcat7-docs-webapp-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: da56d8c84d80899221979f5fbbc6b5473001515d85d73ba39584664d86f92260
tomcat7-el-2.2-api-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 0bc48d86af972f77f4f0eb1a9be7d2bc2165353fb894d5acadff2a44cba61343
tomcat7-javadoc-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: c79a33db08921e7d556bf87ab8778fb9c47a2a7049f69839320ac8e111c5e0fc
tomcat7-jsp-2.2-api-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 6166b9576e7c6bd822e7a4c410279cb8634fd7ca9247bdd8584a195b06810d9a
tomcat7-jsvc-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 7da480ed4d118a6242660d6a05e03f60f8414d591b10be09ccae0ac8f1395be4
tomcat7-lib-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 14ad2ccd7fce5c619e4ebb505b5e38736efeec549ede9cadda4bba063358cb42
tomcat7-log4j-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 9a75819b8d1744964de849400576dba0b768e7402a37cacf010d22cdd334c7a5
tomcat7-selinux-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: dc033fe0cbf6c7dcc0c8914d3e449d61adf5504b9dd059e71ec04af5bb23f64a
tomcat7-servlet-3.0-api-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: 664746487058fb9a199019f3ac7a9bf0082ca34b7d2168d081f1005f6e2e5a90
tomcat7-webapps-7.0.70-16.ep7.el6.noarch.rpm	SHA-256: aafadeb114c66f52f78db40cc8a06f899324a323646adb25e217b54b5b4f2e14
tomcat8-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 2efc0e1eebd92c88a04d9cbadff97868b480e380b44cfcfc452107f39a4486cd
tomcat8-admin-webapps-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: ca8b983289f2b840a199167fe11293870fb299fde3bfcba65e01dba7540c2012
tomcat8-docs-webapp-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: f94e8a92591e678ef76a3c9ccef45313b4529a4c93b9c8c3c2361b8cb0e7e958
tomcat8-el-2.2-api-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 394b574eb1ca09ab54904497f855509c50c57bf1802fcd3b4f69ab001cfbac81
tomcat8-javadoc-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 11d627b5e5d594c4a95f2c0319d441d75044b4e5607f704f368cbb24db4fc91c
tomcat8-jsp-2.3-api-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 36276d484ddc63d554279df4da74fd44efb41442b11a6011b71771b999eadde3
tomcat8-jsvc-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 9f41a63b936c1df94137db967d811e4e0aa127a504dabd8b0eb6abcee5ca83ff
tomcat8-lib-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: b344a30bcb8cacf86c1ea5d869901d3bd562d0ea979ebb6f1deac88e0cdec368
tomcat8-log4j-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: c9793802dac6ebed64cd7ca216cc932eae94cd4aab23193645f8d7104c61bbd9
tomcat8-selinux-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 4fe091a25cb455951327512f511b01f1dc139d39c82f2fd8547bbd6b935a8493
tomcat8-servlet-3.1-api-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: eccdf89317b4648b109ffee273ae3726dcb2f858410edad5eaed47b78b71b4a6
tomcat8-webapps-8.0.36-17.ep7.el6.noarch.rpm	SHA-256: 8ab1ba0cb5f288ec76a81d579375d10ff86c1ac983cdc53e06079055881c80f9