Skip to navigation

Security Advisory Important: tomcat5 security update

Advisory: RHSA-2010:0582-1
Type: Security Advisory
Severity: Important
Issued on: 2010-08-02
Last updated on: 2010-08-02
Affected Products: Application Server v2 EL4
CVEs (cve.mitre.org): CVE-2009-2693
CVE-2009-2902
CVE-2010-2227

Details

Updated tomcat5 packages that fix three security issues are now available
for Red Hat Application Server v2.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

A flaw was found in the way Tomcat handled the Transfer-Encoding header in
HTTP requests. A specially-crafted HTTP request could prevent Tomcat from
sending replies, or cause Tomcat to return truncated replies, or replies
containing data related to the requests of other users, for all subsequent
HTTP requests. (CVE-2010-2227)

Two directory traversal flaws were found in the Tomcat deployment process.
A specially-crafted WAR file could, when deployed, cause a file to be
created outside of the web root into any directory writable by the Tomcat
user, or could lead to the deletion of files in the Tomcat host's work
directory. (CVE-2009-2693, CVE-2009-2902)

Users of Tomcat should upgrade to these updated packages, which contain
backported patches to resolve these issues. Tomcat must be restarted for
this update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Application Server v2 EL4

SRPMS:
tomcat5-5.5.23-0jpp_4rh.17.src.rpm     MD5: c5c5871434e21eac1bbd8b085b48cdef
SHA-256: bffa4004607ed2e07648ecde7781b7d2d62d30fe6b5749e7891fb3d658d2e0a7
 
IA-32:
tomcat5-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 8d53bb59372d8dd48b9a4b8a62d24aa1
SHA-256: 20f835911f5fffbaf63d4a005cfb17809d76619093fbee238ec90c2c07adf117
tomcat5-admin-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 7a5100e483d48e089f469519aee4028b
SHA-256: c8227e0f420e3bf75edf68dd00512be6ff8158d1047857d598eb4bb958c147cf
tomcat5-common-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: b33b779be04fe21c23e1f9a9fe56bf16
SHA-256: 2587716480ef95c8e650c1a6452f61cf0c2b38c03a689d35c2e80dfd1dd715ea
tomcat5-jasper-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 1d18d832577bb60c8f0cca495e8bfac1
SHA-256: 8f1c347ed43ff32ab0e8ac27434710cb506dac9aaf43dcc985850e395535f0fd
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: c753f1182865b8e4c29ee31e22db1d5b
SHA-256: 197cb52c1b337eaab5ff62882892a6758f75b56d1ceb9166d61de073a138e9e8
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 419fcdcbaebfba42701fee5c162e9560
SHA-256: a9128a8c534bef1d843fe54ec77e429cc93d6f6088acbb45ed5bee91e599c4e8
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: f66441ce70748d610c8b83c8929b9037
SHA-256: 947e1c065230efdc2ef5886e4ed026bae881ff6889733b7da50d1c711e4bb9c6
tomcat5-server-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: d51f9919464d18abbfb859de9b4ccbb0
SHA-256: 82709033e22147307c160279e05e4d3e3e3a47e0f9b881e2e208bb19bf3826a9
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 9d5a6c9645da86088bcd7dd1aa777113
SHA-256: 7f54573e0d5700541af01a0d30124b5a014a0ad36814b5c06df0381675a8e6e4
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 73910fd6357131513f64e69cb6c291ab
SHA-256: 19b3b58ca0fa43820e8875e853845534aee3ef1238743c25d3c4997b3adc86e7
tomcat5-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: ecc6577c378a99232cefa80d94d2e1a9
SHA-256: 2e3878422cee0b396a50c90defd3a0fac42e2567ff580a1952cfb1699162360b
 
IA-64:
tomcat5-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 8d53bb59372d8dd48b9a4b8a62d24aa1
SHA-256: 20f835911f5fffbaf63d4a005cfb17809d76619093fbee238ec90c2c07adf117
tomcat5-admin-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 7a5100e483d48e089f469519aee4028b
SHA-256: c8227e0f420e3bf75edf68dd00512be6ff8158d1047857d598eb4bb958c147cf
tomcat5-common-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: b33b779be04fe21c23e1f9a9fe56bf16
SHA-256: 2587716480ef95c8e650c1a6452f61cf0c2b38c03a689d35c2e80dfd1dd715ea
tomcat5-jasper-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 1d18d832577bb60c8f0cca495e8bfac1
SHA-256: 8f1c347ed43ff32ab0e8ac27434710cb506dac9aaf43dcc985850e395535f0fd
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: c753f1182865b8e4c29ee31e22db1d5b
SHA-256: 197cb52c1b337eaab5ff62882892a6758f75b56d1ceb9166d61de073a138e9e8
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 419fcdcbaebfba42701fee5c162e9560
SHA-256: a9128a8c534bef1d843fe54ec77e429cc93d6f6088acbb45ed5bee91e599c4e8
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: f66441ce70748d610c8b83c8929b9037
SHA-256: 947e1c065230efdc2ef5886e4ed026bae881ff6889733b7da50d1c711e4bb9c6
tomcat5-server-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: d51f9919464d18abbfb859de9b4ccbb0
SHA-256: 82709033e22147307c160279e05e4d3e3e3a47e0f9b881e2e208bb19bf3826a9
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 9d5a6c9645da86088bcd7dd1aa777113
SHA-256: 7f54573e0d5700541af01a0d30124b5a014a0ad36814b5c06df0381675a8e6e4
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 73910fd6357131513f64e69cb6c291ab
SHA-256: 19b3b58ca0fa43820e8875e853845534aee3ef1238743c25d3c4997b3adc86e7
tomcat5-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: ecc6577c378a99232cefa80d94d2e1a9
SHA-256: 2e3878422cee0b396a50c90defd3a0fac42e2567ff580a1952cfb1699162360b
 
PPC:
tomcat5-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 8d53bb59372d8dd48b9a4b8a62d24aa1
SHA-256: 20f835911f5fffbaf63d4a005cfb17809d76619093fbee238ec90c2c07adf117
tomcat5-admin-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 7a5100e483d48e089f469519aee4028b
SHA-256: c8227e0f420e3bf75edf68dd00512be6ff8158d1047857d598eb4bb958c147cf
tomcat5-common-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: b33b779be04fe21c23e1f9a9fe56bf16
SHA-256: 2587716480ef95c8e650c1a6452f61cf0c2b38c03a689d35c2e80dfd1dd715ea
tomcat5-jasper-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 1d18d832577bb60c8f0cca495e8bfac1
SHA-256: 8f1c347ed43ff32ab0e8ac27434710cb506dac9aaf43dcc985850e395535f0fd
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: c753f1182865b8e4c29ee31e22db1d5b
SHA-256: 197cb52c1b337eaab5ff62882892a6758f75b56d1ceb9166d61de073a138e9e8
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 419fcdcbaebfba42701fee5c162e9560
SHA-256: a9128a8c534bef1d843fe54ec77e429cc93d6f6088acbb45ed5bee91e599c4e8
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: f66441ce70748d610c8b83c8929b9037
SHA-256: 947e1c065230efdc2ef5886e4ed026bae881ff6889733b7da50d1c711e4bb9c6
tomcat5-server-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: d51f9919464d18abbfb859de9b4ccbb0
SHA-256: 82709033e22147307c160279e05e4d3e3e3a47e0f9b881e2e208bb19bf3826a9
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 9d5a6c9645da86088bcd7dd1aa777113
SHA-256: 7f54573e0d5700541af01a0d30124b5a014a0ad36814b5c06df0381675a8e6e4
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 73910fd6357131513f64e69cb6c291ab
SHA-256: 19b3b58ca0fa43820e8875e853845534aee3ef1238743c25d3c4997b3adc86e7
tomcat5-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: ecc6577c378a99232cefa80d94d2e1a9
SHA-256: 2e3878422cee0b396a50c90defd3a0fac42e2567ff580a1952cfb1699162360b
 
x86_64:
tomcat5-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 8d53bb59372d8dd48b9a4b8a62d24aa1
SHA-256: 20f835911f5fffbaf63d4a005cfb17809d76619093fbee238ec90c2c07adf117
tomcat5-admin-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 7a5100e483d48e089f469519aee4028b
SHA-256: c8227e0f420e3bf75edf68dd00512be6ff8158d1047857d598eb4bb958c147cf
tomcat5-common-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: b33b779be04fe21c23e1f9a9fe56bf16
SHA-256: 2587716480ef95c8e650c1a6452f61cf0c2b38c03a689d35c2e80dfd1dd715ea
tomcat5-jasper-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 1d18d832577bb60c8f0cca495e8bfac1
SHA-256: 8f1c347ed43ff32ab0e8ac27434710cb506dac9aaf43dcc985850e395535f0fd
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: c753f1182865b8e4c29ee31e22db1d5b
SHA-256: 197cb52c1b337eaab5ff62882892a6758f75b56d1ceb9166d61de073a138e9e8
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 419fcdcbaebfba42701fee5c162e9560
SHA-256: a9128a8c534bef1d843fe54ec77e429cc93d6f6088acbb45ed5bee91e599c4e8
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: f66441ce70748d610c8b83c8929b9037
SHA-256: 947e1c065230efdc2ef5886e4ed026bae881ff6889733b7da50d1c711e4bb9c6
tomcat5-server-lib-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: d51f9919464d18abbfb859de9b4ccbb0
SHA-256: 82709033e22147307c160279e05e4d3e3e3a47e0f9b881e2e208bb19bf3826a9
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 9d5a6c9645da86088bcd7dd1aa777113
SHA-256: 7f54573e0d5700541af01a0d30124b5a014a0ad36814b5c06df0381675a8e6e4
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: 73910fd6357131513f64e69cb6c291ab
SHA-256: 19b3b58ca0fa43820e8875e853845534aee3ef1238743c25d3c4997b3adc86e7
tomcat5-webapps-5.5.23-0jpp_4rh.17.noarch.rpm     MD5: ecc6577c378a99232cefa80d94d2e1a9
SHA-256: 2e3878422cee0b396a50c90defd3a0fac42e2567ff580a1952cfb1699162360b
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

559738 - CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
559761 - CVE-2009-2902 tomcat: unexpected file deletion in work directory
612799 - CVE-2010-2227 tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/