ID

VAR-201706-0361

CVE

CVE-2017-5664

TITLE

Apache Tomcat Security restriction bypass vulnerability

DESCRIPTION

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method. Apache Tomcat Contains a security restriction bypass vulnerability. The Apache Software Foundation From Apache Tomcat An update has been released for the following vulnerabilities: * * Security restriction bypass vulnerability related to error page processing (CVE-2017-5664 )Crafted HTTP By processing the request, the error page may be deleted or overwritten. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. ========================================================================== Ubuntu Security Notice USN-3519-1 January 08, 2018 tomcat7, tomcat8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.04 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Tomcat. A remote attacker could use this issue to obtain wrong responses possibly containing sensitive information. (CVE-2017-5664) It was discovered that Tomcat incorrectly handled the CORS filter. (CVE-2017-7674) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.04: libtomcat8-java 8.0.38-2ubuntu2.2 tomcat8 8.0.38-2ubuntu2.2 Ubuntu 16.04 LTS: libtomcat8-java 8.0.32-1ubuntu1.5 tomcat8 8.0.32-1ubuntu1.5 Ubuntu 14.04 LTS: libtomcat7-java 7.0.52-1ubuntu0.13 tomcat7 7.0.52-1ubuntu0.13 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: tomcat6 security update Advisory ID: RHSA-2017:3080-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:3080 Issue date: 2017-10-29 CVE Names: CVE-2017-12615 CVE-2017-12617 CVE-2017-5647 CVE-2017-5664 ===================================================================== 1. Summary: An update for tomcat6 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Optional (v. 6) - noarch Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Enterprise Linux Server Optional (v. 6) - noarch Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Enterprise Linux Workstation Optional (v. 6) - noarch 3. Security Fix(es): * A vulnerability was discovered in Tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5664) * Two vulnerabilities were discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12615, CVE-2017-12617) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1441205 - CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used 1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism 1461851 - The tomcat6 build is incompatible with the ECJ update 1493220 - CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload 1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 6. Package List: Red Hat Enterprise Linux Desktop Optional (v. 6): Source: tomcat6-6.0.24-111.el6_9.src.rpm noarch: tomcat6-6.0.24-111.el6_9.noarch.rpm tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-lib-6.0.24-111.el6_9.noarch.rpm tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: tomcat6-6.0.24-111.el6_9.src.rpm noarch: tomcat6-6.0.24-111.el6_9.noarch.rpm tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-lib-6.0.24-111.el6_9.noarch.rpm tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm Red Hat Enterprise Linux Server (v. 6): Source: tomcat6-6.0.24-111.el6_9.src.rpm noarch: tomcat6-6.0.24-111.el6_9.noarch.rpm tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-lib-6.0.24-111.el6_9.noarch.rpm tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm Red Hat Enterprise Linux Server Optional (v. 6): noarch: tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: tomcat6-6.0.24-111.el6_9.src.rpm noarch: tomcat6-6.0.24-111.el6_9.noarch.rpm tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm tomcat6-lib-6.0.24-111.el6_9.noarch.rpm tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): noarch: tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-12615 https://access.redhat.com/security/cve/CVE-2017-12617 https://access.redhat.com/security/cve/CVE-2017-5647 https://access.redhat.com/security/cve/CVE-2017-5664 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZ9m/mXlSAg2UNWIIRAovAAJ9CpiywXfHnA8IoloN3X8uAiQdctACgrmUU LQvJ4nLI4fBaw5mKqe1aNQY= =G9kA -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. The updates are documented in the Release Notes document linked to in the References. Security Fix(es): * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2017-5664) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). The References section of this erratum contains a download link (you must log in to download the update). Security Fix(es): * It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648) 3

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

security feature problem

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Aniket Nandkishor Kulkarni

SOURCES

LAST UPDATE DATE

2024-09-15T21:08:22.824000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE