Apache Tomcat 8.0.x < 8.0.11 Multiple OpenSSL Vulnerabilities

High Nessus Plugin ID 77476

Synopsis

The remote Apache Tomcat server is affected by multiple vulnerabilities.

Description

According to its self-reported version number, the Apache Tomcat server running on the remote host is 8.0.x prior to 8.0.11. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL :

- An error exists in the function 'ssl3_read_bytes' that could allow data to be injected into other sessions or allow denial of service attacks. Note that this issue is exploitable only if 'SSL_MODE_RELEASE_BUFFERS' is enabled. (CVE-2010-5298)

- A buffer overflow error exists related to invalid DTLS fragment handling that could lead to the execution of arbitrary code. Note that this issue only affects OpenSSL when used as a DTLS client or server.
(CVE-2014-0195)

- An error exists in the function 'do_ssl3_write' that could allow a NULL pointer to be dereferenced leading to denial of service attacks. Note that this issue is exploitable only if 'SSL_MODE_RELEASE_BUFFERS' is enabled. (CVE-2014-0198)

- An error exists related to DTLS handshake handling that could lead to denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client.
(CVE-2014-0221)

- An unspecified error exists that could allow an attacker to cause usage of weak keying material leading to simplified man-in-the-middle attacks. (CVE-2014-0224)

- An unspecified error exists related to anonymous ECDH cipher suites that could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Apache Tomcat version 8.0.11 or later.

See Also

http://tomcat.apache.org/download-80.cgi#8.0.11

https://bz.apache.org/bugzilla/show_bug.cgi?id=56596

https://www.openssl.org/news/secadv/20140605.txt

Plugin Details

Severity: High

ID: 77476

File Name: tomcat_8_0_11.nasl

Version: 1.9

Type: remote

Family: Web Servers

Published: 2014/09/02

Updated: 2018/11/15

Dependencies: 39446, 11936

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 9.3

Temporal Score: 8.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:tomcat

Required KB Items: installed_sw/Apache Tomcat

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/08/22

Vulnerability Publication Date: 2014/06/05

Exploitable With

Core Impact

Reference Information

CVE: CVE-2010-5298, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, CVE-2014-3470

BID: 66801, 67193, 67898, 67899, 67900, 67901

CERT: 978508