Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

The remote Solaris system is missing necessary patches to address security updates :

  - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30     does not properly handle chunk extensions in chunked     transfer coding, which allows remote attackers to cause     a denial of service by streaming data. (CVE-2012-3544)

  - Unspecified vulnerability in the Javadoc component in     Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and     earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21     and earlier; and OpenJDK 7 allows remote attackers to     affect integrity via unknown vectors related to Javadoc.
    NOTE: the previous information is from the June 2013     CPU. Oracle has not commented on claims from another     vendor that this issue is related to frame injection in     HTML that is generated by Javadoc. (CVE-2013-1571)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x     before 8.0.0-RC3, when an HTTP connector or AJP     connector is used, does not properly handle certain     inconsistent HTTP request headers, which allows remote     attackers to trigger incorrect identification of a     request's length and conduct request-smuggling attacks     via (1) multiple Content-Length headers or (2) a     Content-Length header and a 'Transfer-Encoding: chunked'     header. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2005-2090. (CVE-2013-4286)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x     before 8.0.0-RC10 processes chunked transfer coding     without properly handling (1) a large total amount of     chunked data or (2) whitespace characters in an HTTP     header value within a trailer field, which allows remote     attackers to cause a denial of service by streaming     data. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-3544. (CVE-2013-4322)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x     before 8.0.0-RC10 allows attackers to obtain 'Tomcat     internals' information by leveraging the presence of an     untrusted web application with a context.xml, web.xml,

    *.jspx, *.tagx, or *.tld XML document containing an     external entity declaration in conjunction with an     entity reference, related to an XML External Entity     (XXE) issue. (CVE-2013-4590)

  - org/apache/catalina/connector/CoyoteAdapter.java in     Apache Tomcat 6.0.33 through 6.0.37 does not consider     the disableURLRewriting setting when handling a session     ID in a URL, which allows remote attackers to conduct     session fixation attacks via a crafted URL.
    (CVE-2014-0033)

The remote Solaris system is missing necessary patches to address security updates :

  - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30     does not properly handle chunk extensions in chunked     transfer coding, which allows remote attackers to cause     a denial of service by streaming data. (CVE-2012-3544)

  - java/org/apache/catalina/authenticator/FormAuthenticator     .java in the form authentication feature in Apache     Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does     not properly handle the relationships between     authentication requirements and sessions, which allows     remote attackers to inject a request into a session by     sending this request during completion of the login     form, a variant of a session fixation attack.
    (CVE-2013-2067)

The remote host is affected by the vulnerability described in GLSA-201412-29 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tomcat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition as       well as obtain sensitive information, bypass protection mechanisms and       authentication restrictions.
  Workaround :

    There is no known workaround at this time.

It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests. (CVE-2013-4286)

It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default. (CVE-2013-4322)

A denial of service flaw was found in the way Apache Commons FileUpload handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing JBoss Web to enter an infinite loop when processing such an incoming request. (CVE-2014-0050)

- Updated to 7.0.52

    - Create and own %{_localstatedir}/lib/tomcats,       resolves: rhbz#1026741

    - Add pom for tomcat-jdbc, resolves: rhbz#1011003

    - Substitute libnames in catalina-tasks.xml, resolves:
      rhbz#1126439

    - Use CATALINA_OPTS only on start, resolves:
      rhbz#1051194

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tomcat has been updated to version 6.0.41, which brings security and bug fixes.

The following security fixes have been fixed :

  - A XXE vulnerability via user-supplied XSLTs.
    (CVE-2014-0096)

  - Request smuggling via malicious content length header.
    (CVE-2014-0099)

  - A XML parser hijack by malicious web application. Bugs     fixed:. (CVE-2014-0119)

  - Socket bind fails on tomcat startup when using apr     (IPV6). (bnc#881700)

  - classpath for org/apache/juli/logging/LogFactory     (bnc#844689)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1012 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of     components for hosting Java web applications. It is comprised of the Apache     HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector     (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat     Native library.

    This release serves as a replacement for Red Hat JBoss Web Server 2.0.0,     and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.0.1     Release Notes for information on the most significant of these changes,     available shortly from https://access.redhat.com/site/documentation/

    The following security issues are also fixed with this release:

    Cross-site scripting (XSS) flaws were found in the Apache HTTP Server     mod_proxy_balancer module's manager web interface. If a remote attacker     could trick a user, who was logged into the manager web interface, into     visiting a specially-crafted URL, it would lead to arbitrary web script     execution in the context of the user's manager interface session.
    (CVE-2012-4558)

    Cross-site scripting (XSS) flaws were found in the Apache HTTP Server     mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp modules. An     attacker could possibly use these flaws to perform XSS attacks if they were     able to make the victim's browser generate an HTTP request with a     specially-crafted Host header. (CVE-2012-3499)

    A session fixation flaw was found in the Tomcat FormAuthenticator module.
    During a narrow window of time, if a remote attacker sent requests while a     user was logging in, it could possibly result in the attacker's requests     being processed as if they were sent by the user. (CVE-2013-2067)

    A denial of service flaw was found in the way the Tomcat chunked transfer     encoding input filter processed CRLF sequences. A remote attacker could     use this flaw to send an excessively long request, consuming network     bandwidth, CPU, and memory on the Tomcat server. Chunked transfer encoding     is enabled by default. (CVE-2012-3544)

    A flaw was found in the way the Tomcat 7 asynchronous context     implementation performed request management in certain circumstances. If an     application used AsyncListeners and threw RuntimeExceptions, Tomcat could     send a reply that contains information from a different user's request,     possibly leading to the disclosure of sensitive information. This issue     only affected Tomcat 7. (CVE-2013-2071)

    Note: Do not install Red Hat JBoss Web Server 2 on a host which has Red Hat     JBoss Web Server 1 installed.

    Warning: Before applying the update, back up your existing Red Hat JBoss     Web Server installation (including all applications and configuration     files).

    All users of Red Hat JBoss Web Server 2.0.0 on Red Hat Enterprise Linux 6     are advised to upgrade to Red Hat JBoss Web Server 2.0.1. The JBoss server     process must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1011 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of     components for hosting Java web applications. It is comprised of the Apache     HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector     (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat     Native library.

    This release serves as a replacement for Red Hat JBoss Web Server 2.0.0,     and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.0.1     Release Notes for information on the most significant of these changes,     available shortly from https://access.redhat.com/site/documentation/

    The following security issues are also fixed with this release:

    Cross-site scripting (XSS) flaws were found in the Apache HTTP Server     mod_proxy_balancer module's manager web interface. If a remote attacker     could trick a user, who was logged into the manager web interface, into     visiting a specially-crafted URL, it would lead to arbitrary web script     execution in the context of the user's manager interface session.
    (CVE-2012-4558)

    Cross-site scripting (XSS) flaws were found in the Apache HTTP Server     mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp modules. An     attacker could possibly use these flaws to perform XSS attacks if they were     able to make the victim's browser generate an HTTP request with a     specially-crafted Host header. (CVE-2012-3499)

    A session fixation flaw was found in the Tomcat FormAuthenticator module.
    During a narrow window of time, if a remote attacker sent requests while a     user was logging in, it could possibly result in the attacker's requests     being processed as if they were sent by the user. (CVE-2013-2067)

    A denial of service flaw was found in the way the Tomcat chunked transfer     encoding input filter processed CRLF sequences. A remote attacker could     use this flaw to send an excessively long request, consuming network     bandwidth, CPU, and memory on the Tomcat server. Chunked transfer encoding     is enabled by default. (CVE-2012-3544)

    A flaw was found in the way the Tomcat 7 asynchronous context     implementation performed request management in certain circumstances. If an     application used AsyncListeners and threw RuntimeExceptions, Tomcat could     send a reply that contains information from a different user's request,     possibly leading to the disclosure of sensitive information. This issue     only affected Tomcat 7. (CVE-2013-2071)

    Note: Do not install Red Hat JBoss Web Server 2 on a host which has Red Hat     JBoss Web Server 1 installed.

    Warning: Before applying the update, back up your existing Red Hat JBoss     Web Server installation (including all applications and configuration     files).

    All users of Red Hat JBoss Web Server 2.0.0 on Red Hat Enterprise Linux 5     are advised to upgrade to Red Hat JBoss Web Server 2.0.1. The JBoss server     process must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tomcat was updated to fix security issues and bug: CVE-2013-1976:
Avoid a potential symlink race during startup of the tomcat server, where a local attacker that gaine access to the tomcat chroot could escalate privileges to root.

CVE-2013-2067:
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat did not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

CVE-2012-3544: Tomcat were affected by a chunked transfer encoding extension size denial of service vulnerability.

Also the following bug was fixed :

  - Fix tomcat init scripts generating malformed classpath     (http://youtrack.jetbrains.com/issue/JT-18545)     bnc#804992

It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this flaw to poison a web cache, perform cross-site scripting (XSS) attacks, or obtain sensitive information from other requests. (CVE-2013-4286)

It was discovered that the fix for CVE-2012-3544 did not properly resolve a denial of service flaw in the way Tomcat processed chunk extensions and trailing headers in chunked requests. A remote attacker could use this flaw to send an excessively long request that, when processed by Tomcat, could consume network bandwidth, CPU, and memory on the Tomcat server. Note that chunked transfer encoding is enabled by default. (CVE-2013-4322)

A denial of service flaw was found in the way Apache Commons FileUpload handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing JBoss Web to enter an infinite loop when processing such an incoming request. (CVE-2014-0050)

Tomcat must be restarted for this update to take effect.

The version of Tomcat installed on the remote host is prior to 7.0.50. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.50_security-7 advisory.

  - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked     transfer coding, which allows remote attackers to cause a denial of service by streaming data.
    (CVE-2012-3544)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain     Tomcat internals information by leveraging the presence of an untrusted web application with a     context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in     conjunction with an entity reference, related to an XML External Entity (XXE) issue. (CVE-2013-4590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tomcat6 packages fix security vulnerabilities :

It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to stop responding, resulting in a denial of service (CVE-2012-3544).

A frame injection in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc (CVE-2013-1571).

A flaw was found in the way the tomcat6 init script handled the tomcat6-initd.log log file. A malicious web application deployed on Tomcat could use this flaw to perform a symbolic link attack to change the ownership of an arbitrary system file to that of the tomcat user, allowing them to escalate their privileges to root (CVE-2013-1976).

It was discovered that Tomcat incorrectly handled certain authentication requests. A remote attacker could possibly use this flaw to inject a request that would get executed with a victim's credentials (CVE-2013-2067).

Note: With this update, tomcat6-initd.log has been moved from /var/log/tomcat6/ to the /var/log/ directory.

The remote host has a version of Oracle Secure Global Desktop installed that is affected by multiple vulnerabilities :

  - Specially crafted requests sent with chunked transfer     encoding could allow a remote attacker to perform a     'limited' denial of service attack on the Tomcat server.
    (CVE-2012-3544)

  - The Tomcat server is affected by a session fixation     vulnerability in the FORM authenticator. (CVE-2013-2067)

  - The Apache Tomcat AsyncListener method is affected by a     cross-session information disclosure vulnerability when     handling user requests. (CVE-2013-2071)

  - The Administration Console and Workspace Web     Applications subcomponent is affected by an unspecified,     remote vulnerability. (CVE-2014-0419)

This update of tomcat6 fixes :

  - apache-tomcat-CVE-2012-3544.patch. (bnc#831119)

  - use chown --no-dereference to prevent symlink attacks on     log (bnc#822177#c7/prevents CVE-2013-1976)

  - Fix tomcat init scripts generating malformed classpath (     http://youtrack.jetbrains.com/issue/JT-18545 )     bnc#804992 (patch from m407)

  - fix a typo in initscript. (bnc#768772)

  - copy all shell scripts (bnc#818948)

Two security issues have been found in the Tomcat servlet and JSP engine :

  - CVE-2012-3544     The input filter for chunked transfer encodings could     trigger high resource consumption through malformed CRLF     sequences, resulting in denial of service.

  - CVE-2013-2067     The FormAuthenticator module was vulnerable to session     fixation.

It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to stop responding, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2012-3544)

It was discovered that Tomcat incorrectly handled certain authentication requests. A remote attacker could possibly use this flaw to inject a request that would get executed with a victim's credentials. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, and Ubuntu 12.10. (CVE-2013-2067)

It was discovered that Tomcat sometimes exposed elements of a previous request to the current request. This could allow a remote attacker to possibly obtain sensitive information. This issue only affected Ubuntu 12.10 and Ubuntu 13.04. (CVE-2013-2071).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Apache Tomcat earlier than 6.0.37 are potentially affected by multiple vulnerabilities :

  - An error exists related to chunked transfer encoding and extensions that could allow limited denial of service attacks. (CVE-2012-3544)

  - An error exists related to HTML form authentication and session fixation that could allow an attacker to carry out requests using a victim's credentials. (CVE-2013-2067)

According to its self-reported version number, the instance of Apache Tomcat 6.0 listening on the remote host is prior to 6.0.37. It is, therefore, affected by multiple vulnerabilities :

  - An error exists related to chunked transfer encoding     and extensions that allows limited denial of service     attacks. (CVE-2012-3544)

  - An error exists related to HTML form authentication and     session fixation that allows an attacker to carry out     requests using a victim's credentials. (CVE-2013-2067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 7.0 listening on the remote host is prior to 7.0.30. It is, therefore, affected by the following vulnerabilities :

 - An error related to chunked transfer encoding and extensions allows limited denial of service attacks. (CVE-2012-3544)

 - An error exists related to FORM authentication that allows security bypass if 'j_security_check' is appended to the request. (CVE-2012-3546)

 - Replay-countermeasure functionality in HTTP Digest Access Authentication tracks cnonce values instead of nonce values, which makes it easier for attackers to bypass access restrictions by sniffing the network for valid requests. (CVE-2012-5885)

 - HTTP Digest Access Authentication implementation caches information about the authenticated user, which allows an attacker to bypass authentication via session ID. (CVE-2012-5886)

 - HTTP Digest Access Authentication implementation does not properly check for stale nonce values with enforcement of proper credentials, which allows an attacker to bypass restrictions by sniffing requests. (CVE-2012-5887)

Note that Nessus Network Monitor has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.30. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.30_security-7 advisory.

  - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked     transfer coding, which allows remote attackers to cause a denial of service by streaming data.
    (CVE-2012-3544)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5885, CVE-2012-5886,     CVE-2012-5887. Reason: This candidate is a duplicate of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887.
    Notes: All CVE users should reference one or more of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887     instead of this candidate. All references and descriptions in this candidate have been removed to prevent     accidental usage. (CVE-2012-3439)

  - org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when     FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a     previous setUserPrincipal call and then placing /j_security_check at the end of a URI. (CVE-2012-3546)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
80793	Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_apache_tomcat4)	Nessus	Solaris Local Security Checks	medium
80792	Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_tomcat)	Nessus	Solaris Local Security Checks	medium
79982	GLSA-201412-29 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
78287	Amazon Linux AMI : tomcat6 (ALAS-2014-344)	Nessus	Amazon Linux Local Security Checks	high
77928	Fedora 20 : tomcat-7.0.52-1.fc20 (2014-11048)	Nessus	Fedora Local Security Checks	medium
77197	SuSE 11.3 Security Update : tomcat6 (SAT Patch Number 9487)	Nessus	SuSE Local Security Checks	medium
76238	RHEL 6 : Red Hat JBoss Web Server 2.0.1 update (Moderate) (RHSA-2013:1012)	Nessus	Red Hat Local Security Checks	medium
76237	RHEL 5 : Red Hat JBoss Web Server 2.0.1 update (Moderate) (RHSA-2013:1011)	Nessus	Red Hat Local Security Checks	medium
75107	openSUSE Security Update : tomcat (openSUSE-SU-2013:1307-1)	Nessus	SuSE Local Security Checks	medium
73679	Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20140423)	Nessus	Scientific Linux Local Security Checks	high
72691	Apache Tomcat 7.0.0 < 7.0.50 multiple vulnerabilities	Nessus	Web Servers	medium
72595	Mandriva Linux Security Advisory : tomcat6 (MDVSA-2014:042)	Nessus	Mandriva Local Security Checks	medium
72339	Oracle Secure Global Desktop Multiple Vulnerabilities (January 2014 CPU)	Nessus	Misc.	medium
69458	SuSE 11.2 / 11.3 Security Update : tomcat6 (SAT Patch Numbers 8155 / 8156)	Nessus	SuSE Local Security Checks	medium
68971	Debian DSA-2725-1 : tomcat6 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
66670	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : tomcat6, tomcat7 vulnerabilities (USN-1841-1)	Nessus	Ubuntu Local Security Checks	medium
6832	Apache Tomcat 6.0.x < 6.0.37 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
66426	Apache Tomcat 6.0.x < 6.0.37 Multiple Vulnerabilities	Nessus	Web Servers	medium
6624	Apache Tomcat 7.0.x < 7.0.30 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
62988	Apache Tomcat 7.0.0 < 7.0.30 multiple vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2012-3544

medium

Tenable Plugins

medium

medium

high

high

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium