CentOS 5 : tomcat (CESA-2007:0871)

Medium Nessus Plugin ID 43651

Synopsis

The remote CentOS host is missing one or more security updates.

Description

Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and Java Server Pages technologies.

Tomcat was found treating single quote characters -- ' -- as delimiters in cookies. This could allow remote attackers to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3382).

It was reported Tomcat did not properly handle the following character sequence in a cookie: \' (a backslash followed by a double-quote). It was possible remote attackers could use this failure to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3385).

A cross-site scripting (XSS) vulnerability existed in the Host Manager Servlet. This allowed remote attackers to inject arbitrary HTML and web script via crafted requests (CVE-2007-3386).

Users of Tomcat should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

Solution

Update the affected tomcat packages.

See Also

http://www.nessus.org/u?ffe1d9a4

http://www.nessus.org/u?bf8e66f1

Plugin Details

Severity: Medium

ID: 43651

File Name: centos_RHSA-2007-0871.nasl

Version: 1.11

Type: local

Agent: unix

Published: 2010/01/06

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:centos:centos:tomcat5, p-cpe:/a:centos:centos:tomcat5-admin-webapps, p-cpe:/a:centos:centos:tomcat5-common-lib, p-cpe:/a:centos:centos:tomcat5-jasper, p-cpe:/a:centos:centos:tomcat5-jasper-javadoc, p-cpe:/a:centos:centos:tomcat5-jsp-2.0-api, p-cpe:/a:centos:centos:tomcat5-jsp-2.0-api-javadoc, p-cpe:/a:centos:centos:tomcat5-server-lib, p-cpe:/a:centos:centos:tomcat5-servlet-2.4-api, p-cpe:/a:centos:centos:tomcat5-servlet-2.4-api-javadoc, p-cpe:/a:centos:centos:tomcat5-webapps, cpe:/o:centos:centos:5

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2007/09/28

Reference Information

CVE: CVE-2007-3382, CVE-2007-3385, CVE-2007-3386

BID: 25316

RHSA: 2007:0871

CWE: 79, 200