Mandriva Linux Security Advisory : tomcat (MDVSA-2015:084)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Updated tomcat package fixes security vulnerabilities :

It was discovered that the Apache Commons FileUpload package for Java
could enter an infinite loop while processing a multipart request with
a crafted Content-Type, resulting in a denial-of-service condition
(CVE-2014-0050).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding
without properly handling (1) a large total amount of chunked data or
(2) whitespace characters in an HTTP header value within a trailer
field, which allows remote attackers to cause a denial of service by
streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat
internals information by leveraging the presence of an untrusted web
application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML
document containing an external entity declaration in conjunction with
an entity reference, related to an XML External Entity (XXE) issue
(CVE-2013-4590).

Integer overflow in the parseChunkHeader function in
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in
Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote
attackers to cause a denial of service (resource consumption) via a
malformed chunk size in chunked transfer coding of a request during
the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default
servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not
properly restrict XSLT stylesheets, which allows remote attackers to
bypass security-manager restrictions and read arbitrary files via a
crafted web application that provides an XML external entity
declaration in conjunction with an entity reference, related to an XML
External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in
Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated
behind a reverse proxy, allows remote attackers to conduct HTTP
request smuggling attacks via a crafted Content-Length HTTP header
(CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly
constrain the class loader that accesses the XML parser used with an
XSLT stylesheet, which allows remote attackers to read arbitrary files
via a crafted web application that provides an XML external entity
declaration in conjunction with an entity reference, related to an XML
External Entity (XXE) issue, or read files associated with different
web applications on a single Tomcat instance via a crafted web
application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a
malformed chunk as part of a chunked request that caused Tomcat to
read part of the request body as a new request (CVE-2014-0227).

See also :

http://advisories.mageia.org/MGASA-2014-0110.html
http://advisories.mageia.org/MGASA-2014-0149.html
http://advisories.mageia.org/MGASA-2014-0268.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 82337 ()

Bugtraq ID:

CVE ID: CVE-2013-4322
CVE-2013-4590
CVE-2014-0050
CVE-2014-0075
CVE-2014-0096
CVE-2014-0099
CVE-2014-0119
CVE-2014-0227

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now