Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:136)

medium Nessus Plugin ID 39485

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple security vulnerabilities has been identified and fixed in tomcat5 :

When Tomcat's WebDAV servlet is configured for use with a context and has been enabled for write, some WebDAV requests that specify an entity with a SYSTEM tag can result in the contents of arbitary files being returned to the client (CVE-2007-5461).

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of a duplicate copy of one of the recent requests, as demonstrated by using netcat to send the empty request (CVE-2007-6286).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request (CVE-2008-5515).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header (CVE-2009-0033).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter (CVE-2009-0580).

The calendar application in the examples web application contains an XSS flaw due to invalid HTML which renders the XSS filtering protection ineffective (CVE-2009-0781).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application (CVE-2009-0783).

The updated packages have been patched to prevent this.

Solution

Update the affected packages.

See Also

http://tomcat.apache.org/security-5.html

Plugin Details

Severity: Medium

ID: 39485

File Name: mandriva_MDVSA-2009-136.nasl

Version: 1.20

Type: local

Published: 6/23/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:tomcat5, p-cpe:/a:mandriva:linux:tomcat5-admin-webapps, p-cpe:/a:mandriva:linux:tomcat5-common-lib, p-cpe:/a:mandriva:linux:tomcat5-jasper, p-cpe:/a:mandriva:linux:tomcat5-jasper-eclipse, p-cpe:/a:mandriva:linux:tomcat5-jasper-javadoc, p-cpe:/a:mandriva:linux:tomcat5-jsp-2.0-api, p-cpe:/a:mandriva:linux:tomcat5-jsp-2.0-api-javadoc, p-cpe:/a:mandriva:linux:tomcat5-server-lib, p-cpe:/a:mandriva:linux:tomcat5-servlet-2.4-api, p-cpe:/a:mandriva:linux:tomcat5-servlet-2.4-api-javadoc, p-cpe:/a:mandriva:linux:tomcat5-webapps, cpe:/o:mandriva:linux:2008.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/22/2009

Exploitable With

CANVAS (D2ExploitPack)

Reference Information

CVE: CVE-2007-5461, CVE-2007-6286, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, CVE-2009-0783

BID: 35193, 35196, 35263, 35416

CWE: 20, 200, 22, 79

MDVSA: 2009:136