Advisories MDVSA-2010:176: tomcat5

[paul]

Multiple vulnerabilities has been found and corrected in tomcat5:

 

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0

through 4.1.36 does not properly handle (1) double quote (") characters

or (2) %5C (encoded backslash) sequences in a cookie value, which

might cause sensitive information such as session IDs to be leaked

to remote attackers and enable session hijacking attacks. NOTE:

this issue exists because of an incomplete fix for CVE-2007-3385

(CVE-2007-5333).

 

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through

6.0.18, and possibly earlier versions normalizes the target pathname

before filtering the query string when using the RequestDispatcher

method, which allows remote attackers to bypass intended access

restrictions and conduct directory traversal attacks via .. (dot dot)

sequences and the WEB-INF directory in a Request (CVE-2008-5515).

 

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0

through 6.0.18, when the Java AJP connector and mod_jk load balancing

are used, allows remote attackers to cause a denial of service

(application outage) via a crafted request with invalid headers,

related to temporary blocking of connectors that have encountered

errors, as demonstrated by an error involving a malformed HTTP Host

header (CVE-2009-0033).

 

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and

6.0.0 through 6.0.18, when FORM authentication is used, allows

remote attackers to enumerate valid usernames via requests to

/j_security_check with malformed URL encoding of passwords, related to

improper error checking in the (1) MemoryRealm, (2) DataSourceRealm,

and (3) JDBCRealm authentication realms, as demonstrated by a %

(percent) value for the j_password parameter (CVE-2009-0580).

 

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0

through 6.0.18 permits web applications to replace an XML parser used

for other web applications, which allows local users to read or modify

the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web

applications via a crafted application that is loaded earlier than

the target application (CVE-2009-0783).

 

Directory traversal vulnerability in Apache Tomcat 5.5.0 through

5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or

overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file,

as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693).

 

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and

6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase

files that remain from a failed undeploy, which might allow remote

attackers to bypass intended authentication requirements via HTTP

requests (CVE-2009-2901).

 

Directory traversal vulnerability in Apache Tomcat 5.5.0 through

5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete

work-directory files via directory traversal sequences in a WAR

filename, as demonstrated by the ...war filename (CVE-2009-2902).

 

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might

allow remote attackers to discover the server's hostname or IP

address by sending a request for a resource that requires (1) BASIC or

(2) DIGEST authentication, and then reading the realm field in the

WWW-Authenticate header in the reply (CVE-2010-1157).

 

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0

beta does not properly handle an invalid Transfer-Encoding header,

which allows remote attackers to cause a denial of service (application

outage) or obtain sensitive information via a crafted header that

interferes with recycling of a buffer. (CVE-2010-2227)

 

Packages for 2008.0 are provided as of the Extended Maintenance

Program. Please visit this link to learn more:

http://store.mandriva.com/product_info.php?cPath=149&products_id=490

 

The updated packages have been patched to correct these issues.