Issued:
2007-05-24
Updated:
2007-05-24

RHSA-2007:0328 - Important: tomcat security update

Synopsis

Important: tomcat security update

Type/Severity

Security Advisory Important

Topic

Updated tomcat packages that fix multiple security issues and a bug are now available for Red Hat Developer Suite 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Description

Tomcat is a servlet container for Java Servlet and JavaServer Pages technologies.

Tomcat was found to accept multiple content-length headers in a request. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks. (CVE-2005-2090)

Tomcat permitted various characters as path delimiters. If Tomcat was used behind certain proxies and configured to only proxy some contexts, an attacker could construct an HTTP request to work around the context restriction and potentially access non-proxied content. (CVE-2007-0450)

The implict-objects.jsp file distributed in the examples webapp displayed a number of unfiltered header values. If the JSP examples are accessible, this flaw could allow a remote attacker to perform cross-site scripting attacks. (CVE-2006-7195)

Updated jakarta-commons-modeler packages which correct a bug when used with Tomcat 5.5.23 are also included.

Users should upgrade to these erratum packages which contain an update to Tomcat that resolves these issues.

Solution

Note: /etc/tomcat5/web.xml has been updated to disable directory listing by default. If you have previously modified /etc/tomcat5/web.xml, this change will not be made automatically and you should manually update the value for the "listings" parameter to "false".

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory only contains the desired RPMs.

Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

Affected Products

ProductVersionArch
Red Hat Developer Suite v.33x86_64
Red Hat Developer Suite v.33ppc
Red Hat Developer Suite v.33ia64
Red Hat Developer Suite v.33i386

Updated Packages

  • jakarta-commons-modeler-2.0-3jpp_3rh.noarch.rpm
  • tomcat5-jsp-2.0-api-5.5.23-0jpp_6rh.noarch.rpm
  • tomcat5-common-lib-5.5.23-0jpp_6rh.noarch.rpm
  • tomcat5-jasper-5.5.23-0jpp_6rh.noarch.rpm
  • tomcat5-5.5.23-0jpp_6rh.noarch.rpm
  • tomcat5-server-lib-5.5.23-0jpp_6rh.noarch.rpm
  • tomcat5-servlet-2.4-api-5.5.23-0jpp_6rh.noarch.rpm

Fixes

CVEs

References

Additional information