Skip to navigation

Security Advisory Moderate: tomcat security update

Advisory: RHSA-2007:0876-4
Type: Security Advisory
Severity: Moderate
Issued on: 2007-10-11
Last updated on: 2007-10-11
Affected Products: Application Server v2 EL4
CVEs (cve.mitre.org): CVE-2007-1358
CVE-2007-2449
CVE-2007-2450
CVE-2007-3382
CVE-2007-3385
CVE-2007-3386

Details

Updated tomcat packages that fix multiple security issues are now available
for Red Hat Application Server v2.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and Java Server Pages
technologies.

Tomcat incorrectly handled "Accept-Language" headers that do not conform to
RFC 2616. An attacker was able to perform cross-site scripting (XSS)
attacks in certain applications (CVE-2007-1358).

Some JSPs within the 'examples' web application did not escape user
provided data. If the JSP examples were accessible, this flaw could allow a
remote attacker to perform cross-site scripting attacks (CVE-2007-2449).

Note: it is recommended the 'examples' web application not be installed on
a production system.

The Manager and Host Manager web applications did not escape user provided
data. If a user is logged in to the Manager or Host Manager web
application, an attacker could perform a cross-site scripting attack
(CVE-2007-2450).

Tomcat was found treating single quote characters -- ' -- as delimiters in
cookies. This could allow remote attackers to obtain sensitive information,
such as session IDs, for session hijacking attacks (CVE-2007-3382).

It was reported Tomcat did not properly handle the following character
sequence in a cookie: \" (a backslash followed by a double-quote). It was
possible remote attackers could use this failure to obtain sensitive
information, such as session IDs, for session hijacking attacks
(CVE-2007-3385).

A cross-site scripting (XSS) vulnerability existed in the Host Manager
Servlet. This allowed remote attackers to inject arbitrary HTML and web
script via crafted requests (CVE-2007-3386).

Users of Tomcat should update to these erratum packages, which contain
backported patches and are not vulnerable to these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Application Server v2 EL4

SRPMS:
tomcat5-5.5.23-0jpp_4rh.4.src.rpm
File outdated by:  RHSA-2010:0582
    MD5: c8a9674009457794d5969b0a4db09888
 
IA-32:
tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 92c991a50808cc48ff7538e3320cd146
tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 364a741ad7d232a9fe1cf3e183001520
tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: c7afc607c579c4db42bcc094df7b5498
tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 044ec1d57f92903b32c4dd3f97211ea4
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 2790253849bae9be0960517cfd781c4c
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0d64bdd04f35659f0b425843bf4cfda2
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 7b8448505ae5e74010fa8fb37084dd6e
tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 3397d6f2b3ed49fcaa5616fb3363c0ce
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 8f28858bc131b40e9effdac8f0d445ad
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0ea67bc6674bbc1e6fc50809a6594d9b
tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 6ca13028e1547f3630aefcfd73a84424
 
IA-64:
tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 92c991a50808cc48ff7538e3320cd146
tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 364a741ad7d232a9fe1cf3e183001520
tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: c7afc607c579c4db42bcc094df7b5498
tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 044ec1d57f92903b32c4dd3f97211ea4
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 2790253849bae9be0960517cfd781c4c
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0d64bdd04f35659f0b425843bf4cfda2
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 7b8448505ae5e74010fa8fb37084dd6e
tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 3397d6f2b3ed49fcaa5616fb3363c0ce
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 8f28858bc131b40e9effdac8f0d445ad
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0ea67bc6674bbc1e6fc50809a6594d9b
tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 6ca13028e1547f3630aefcfd73a84424
 
PPC:
tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 92c991a50808cc48ff7538e3320cd146
tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 364a741ad7d232a9fe1cf3e183001520
tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: c7afc607c579c4db42bcc094df7b5498
tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 044ec1d57f92903b32c4dd3f97211ea4
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 2790253849bae9be0960517cfd781c4c
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0d64bdd04f35659f0b425843bf4cfda2
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 7b8448505ae5e74010fa8fb37084dd6e
tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 3397d6f2b3ed49fcaa5616fb3363c0ce
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 8f28858bc131b40e9effdac8f0d445ad
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0ea67bc6674bbc1e6fc50809a6594d9b
tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 6ca13028e1547f3630aefcfd73a84424
 
x86_64:
tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 92c991a50808cc48ff7538e3320cd146
tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 364a741ad7d232a9fe1cf3e183001520
tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: c7afc607c579c4db42bcc094df7b5498
tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 044ec1d57f92903b32c4dd3f97211ea4
tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 2790253849bae9be0960517cfd781c4c
tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0d64bdd04f35659f0b425843bf4cfda2
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 7b8448505ae5e74010fa8fb37084dd6e
tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 3397d6f2b3ed49fcaa5616fb3363c0ce
tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 8f28858bc131b40e9effdac8f0d445ad
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 0ea67bc6674bbc1e6fc50809a6594d9b
tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
File outdated by:  RHSA-2010:0582
    MD5: 6ca13028e1547f3630aefcfd73a84424
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

244803 - CVE-2007-1358 tomcat accept-language xss flaw
244804 - CVE-2007-2449 tomcat examples jsp XSS
244808 - CVE-2007-2450 tomcat host manager XSS
247972 - CVE-2007-3382 tomcat handling of cookies
247976 - CVE-2007-3385 tomcat handling of cookie values
247994 - CVE-2007-3386 tomcat host manager xss


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/