openSUSE Security Update : tomcat (openSUSE-SU-2013:1306-1)

Medium Nessus Plugin ID 75106


The remote openSUSE host is missing a security update.


Tomcat was updated to fix two security issues: CVE-2013-1976: Avoid a potential symlink race during startup of the tomcat server, where a local attacker that gaine access to the tomcat chroot could escalate privileges to root.

java/org/apache/catalina/core/ in Apache Tomcat 7.x did not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.


Update the affected tomcat packages.

See Also

Plugin Details

Severity: Medium

ID: 75106

File Name: openSUSE-2013-632.nasl

Version: $Revision: 1.1 $

Type: local

Agent: unix

Published: 2014/06/13

Modified: 2014/06/13

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.9

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:tomcat, p-cpe:/a:novell:opensuse:tomcat-admin-webapps, p-cpe:/a:novell:opensuse:tomcat-docs-webapp, p-cpe:/a:novell:opensuse:tomcat-el-2_2-api, p-cpe:/a:novell:opensuse:tomcat-javadoc, p-cpe:/a:novell:opensuse:tomcat-jsp-2_2-api, p-cpe:/a:novell:opensuse:tomcat-jsvc, p-cpe:/a:novell:opensuse:tomcat-lib, p-cpe:/a:novell:opensuse:tomcat-servlet-3_0-api, p-cpe:/a:novell:opensuse:tomcat-webapps, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2013/10/03

Reference Information

CVE: CVE-2013-1976, CVE-2013-2071