Synopsis

Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat JBoss Web Server 3 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements.

Security Fix(es):

• It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. (CVE-2016-1240)
  
• It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)
  
• The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)
  
• A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
  
• It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)
  
• A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)
  
• The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)
  
• It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018)
  
• It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794)
  
• It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)
  
• It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797)
  

The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Enhancement(s):

• This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-268)

Solution

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• JBoss Enterprise Web Server 3 for RHEL 7 x86_64

Fixes

• BZ - 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service
• BZ - 1367447 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation
• BZ - 1376712 - CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation
• BZ - 1390493 - CVE-2016-6797 tomcat: unrestricted access to global resources
• BZ - 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters
• BZ - 1390520 - CVE-2016-6794 tomcat: system property disclosure
• BZ - 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function
• BZ - 1390526 - CVE-2016-0762 tomcat: timing attack in Realm implementation
• BZ - 1397484 - CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
• BZ - 1397485 - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
• BZ - 1403824 - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing

CVEs

• CVE-2016-0762
• CVE-2016-1240
• CVE-2016-3092
• CVE-2016-5018
• CVE-2016-6325
• CVE-2016-6794
• CVE-2016-6796
• CVE-2016-6797
• CVE-2016-6816
• CVE-2016-8735
• CVE-2016-8745

References

• https://access.redhat.com/security/updates/classification/#important

JBoss Enterprise Web Server 3 for RHEL 7

SRPM
hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.src.rpm	SHA-256: d969bf6a5d882a72fce3780685719bdc267b04f7385e99ac9c5d56ccbd0be9a2
jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el7.src.rpm	SHA-256: ad5b9d058c2c8cb54b215121e5d86813c9f4cfd039165dbfe34ab74a379fe161
jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el7.src.rpm	SHA-256: c26450f911316ec4dd54f46764f2b00e6094924b190764fc5c76819f439b2bca
mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el7.src.rpm	SHA-256: f9c8779cbae5e9815364736cbe45aa663e316b1597f4a09f24421c4ed350fb8d
tomcat-native-1.2.8-9.redhat_9.ep7.el7.src.rpm	SHA-256: a6aa4873df7e422cb96611b09da1490d1283127fd050d38e2ce930bad6395356
tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el7.src.rpm	SHA-256: cb1eeda2e24cc73a4b5ddda13b1b1cd8362dc977eeb44e9096e20e2bbcb98bc8
tomcat7-7.0.70-16.ep7.el7.src.rpm	SHA-256: 31e20d0653cf31df28c1c1d2d7db524e85775301edae23c903893a7cb1c32f77
tomcat8-8.0.36-17.ep7.el7.src.rpm	SHA-256: d2133433203579e942eebf8b232fd284c3bedea8919fae4f923d8eed757432cf
x86_64
hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm	SHA-256: 4469a7257c6ee7374693c25cbadad18f91e9f31eeabc0c7b3d008c74f732ab34
hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm	SHA-256: e5d60b4cb7f180d242c0c6fe32420a1cad3bf1fa23a00c2e7ed321ca0f3d05f4
hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm	SHA-256: f13ccb1b16308a0e932e7abc8700991713f9e7d4d925cb420ba639295a9edcb5
hibernate4-entitymanager-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm	SHA-256: 31b4ea29665b011b99477d3fa271f9fb12ebb2607d21d21f3358d829aabff0b3
hibernate4-envers-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm	SHA-256: 559dc544154866050aee438b2d16b6005bcd0947d5e78ee953ea8ddae6a75a3c
jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el7.noarch.rpm	SHA-256: 5159ec5eeeb865a8419a63a65490bec6baf83738ae9a3d0e9fca405841b81f07
jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el7.x86_64.rpm	SHA-256: 1772e1e49dc8dbd143001041bc3adfcd944a539beec38dea4ccf1d264daaef4a
jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el7.x86_64.rpm	SHA-256: 765fc72ba3dba679185c2154e4e3cde96356567ea0f49114bf4f2b42aeb96f8f
jbcs-httpd24-runtime-1-3.jbcs.el7.noarch.rpm	SHA-256: 1bb60d9b671f354d8f756467c985d3247e521173098a4194c89eb90d08ac8107
mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el7.noarch.rpm	SHA-256: ec670aac484e317251af1498c5d2e78610dd547395cfd21ef49b86a2d70e501b
mod_cluster-tomcat7-1.3.5-2.Final_redhat_2.1.ep7.el7.noarch.rpm	SHA-256: b1ffa7aa03b7db9ef212107b6d38fe25ebc7a8741ded57edb05510c4bb4370df
mod_cluster-tomcat8-1.3.5-2.Final_redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 31ad6bb4aab9ea055b0d7364addae9b84552a7e8b8f43c03df95c7b0c650010e
tomcat-native-1.2.8-9.redhat_9.ep7.el7.x86_64.rpm	SHA-256: ef8fa42a0b7d4e39f3541e097df8d28b5b84173765b189467a0822249a403afa
tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el7.x86_64.rpm	SHA-256: d1786e2685df4166e74e1cc73bc51837ababd13b4db4c9f4f10199221a5b4ef2
tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el7.noarch.rpm	SHA-256: adabae2edbdcf4458f455fa66d683aec5d78a0035143d19f1af610e0f285c123
tomcat7-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 72fd6b0ddd109e027b55a6e03837e2a83dddf58618fa9126936313d255525913
tomcat7-admin-webapps-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 039782bf5fbcb9111eaf18c188ec10847af0430c222b805efd1afbd0dbb18285
tomcat7-docs-webapp-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: d4fcc14a471727f72dd6c61a940fae39af7fb6ebb9633f3e5e9749402b20ff9f
tomcat7-el-2.2-api-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 6453de7b71c6f98b70cca445f7f3916eba2fe9cc95fccc22ba7c3497be67f74a
tomcat7-javadoc-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 9af4956478548d028b7d50e71adf4150e4b4bed8e29d6000b8d7f53beaf9d922
tomcat7-jsp-2.2-api-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 224b54833ed18729d5feb511ef3e315cc1de6c97b807de81203f9ee87fca0b10
tomcat7-jsvc-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 8c83dd2d1b3a15334570d5ffa023807fbfb6f80fbd8871f6bf313373f5004fbe
tomcat7-lib-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: d89839a803ce98dd49ba8a887a11cd4e5ece9a159feefa73e1f0a6bdb0c7301f
tomcat7-log4j-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: f8fd0129242310cf0afc01c12ab2cc12d31a240e0197c1816c45f6e40682a0fc
tomcat7-selinux-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 6de0640ce8eff08114b764bde7b56f241bab5cf3f9c5339e361e387048d762d1
tomcat7-servlet-3.0-api-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: bcf85a99010e9077f92023d21b0a2e3cab758a3b437d2bdd37b91820347ad20b
tomcat7-webapps-7.0.70-16.ep7.el7.noarch.rpm	SHA-256: 584f6941c954c2ff358e0b6a1a7c2038242a483d7a1a86f4f401c2b9aacf169a
tomcat8-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 74924f393d7620bbf9c8df71da3f82480a84584c070a6c982ef1a4f2ca0b0f4b
tomcat8-admin-webapps-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: d27752347523ad60aa98c474364081a499d7600f3fa84a3c3891b016ffa8e916
tomcat8-docs-webapp-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 25778f9466fbd3f1b36a1a8253c3ed77d3b5a7658675e1ab0f2ea2af319f106d
tomcat8-el-2.2-api-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 9047b24129923c8b8074e31f86f20fe842b6725dbdd0e3e0399e195d3b1be9c7
tomcat8-javadoc-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: e7a91e60ce2fe8e094d48f1222a20c3b886d0b232b883037cf25263b8364c72b
tomcat8-jsp-2.3-api-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 6363b8713a3fef2fc101a2b34df9988032f0bee3bbf774e460620cb8edb4b1bf
tomcat8-jsvc-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: a42c2676a4d801671232045b18ebee07fb00eec58b1ac104fff1732ce2e02c7f
tomcat8-lib-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 947c1db92b46ae54e6300a16badabde72536db732aee6aacd4eaa23f16ebe490
tomcat8-log4j-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 8d83c7279f8aadf474a48fceff517b45f1eba4f82d159f58e3bfc9a99c8bcfeb
tomcat8-selinux-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 359eb537d274006a33926af16ead1e9de3c2ae9cb1d065c8b163379865084417
tomcat8-servlet-3.1-api-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: a47e4a2e23907dcbf46e9fbd76de4d6d1b77476c39650e801e702d0a08dcbe4a
tomcat8-webapps-8.0.36-17.ep7.el7.noarch.rpm	SHA-256: 75baef21244eb2c1cbc418e6b1b40c84afd9878b07a99b4598cb96bc65b7a719