Mandriva Linux Security Advisory : tomcat6 (MDVSA-2015:053)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Updated tomcat6 packages fix security vulnerabilities :

Integer overflow in the parseChunkHeader function in
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in
Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote
attackers to cause a denial of service (resource consumption) via a
malformed chunk size in chunked transfer coding of a request during
the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default
servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not
properly restrict XSLT stylesheets, which allows remote attackers to
bypass security-manager restrictions and read arbitrary files via a
crafted web application that provides an XML external entity
declaration in conjunction with an entity reference, related to an XML
External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in
Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated
behind a reverse proxy, allows remote attackers to conduct HTTP
request smuggling attacks via a crafted Content-Length HTTP header
(CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly
constrain the class loader that accesses the XML parser used with an
XSLT stylesheet, which allows remote attackers to read arbitrary files
via a crafted web application that provides an XML external entity
declaration in conjunction with an entity reference, related to an XML
External Entity (XXE) issue, or read files associated with different
web applications on a single Tomcat instance via a crafted web
application (CVE-2014-0119).

In Apache Tomcat 6.x before 6.0.55, it was possible to craft a
malformed chunk as part of a chunked request that caused Tomcat to
read part of the request body as a new request (CVE-2014-0227).

See also :

http://advisories.mageia.org/MGASA-2014-0268.html
http://advisories.mageia.org/MGASA-2015-0081.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)
CVSS Temporal Score : 5.6
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Mandriva Local Security Checks

Nessus Plugin ID: 81936 ()

Bugtraq ID: 67667
67668
67669
67671
72717

CVE ID: CVE-2014-0075
CVE-2014-0096
CVE-2014-0099
CVE-2014-0119
CVE-2014-0227

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now