ID

VAR-201706-0361

CVE

CVE-2017-5664

TITLE

Apache Tomcat Security restriction bypass vulnerability

DESCRIPTION

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method. Apache Tomcat Contains a security restriction bypass vulnerability. The Apache Software Foundation From Apache Tomcat An update has been released for the following vulnerabilities: * * Security restriction bypass vulnerability related to error page processing (CVE-2017-5664 )Crafted HTTP By processing the request, the error page may be deleted or overwritten. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. The updates are documented in the Release Notes document linked to in the References. Security Fix(es): * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * A vulnerability was discovered in tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5664) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). After installing the updated packages, the httpd daemon will be restarted automatically. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: tomcat security update Advisory ID: RHSA-2017:1809-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:1809 Issue date: 2017-07-27 CVE Names: CVE-2017-5648 CVE-2017-5664 ===================================================================== 1. Summary: An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch Red Hat Enterprise Linux Client Optional (v. 7) - noarch Red Hat Enterprise Linux ComputeNode (v. 7) - noarch Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Enterprise Linux Server Optional (v. 7) - noarch Red Hat Enterprise Linux Workstation (v. 7) - noarch Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch 3. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1441223 - CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object 1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: tomcat-7.0.69-12.el7_3.src.rpm noarch: tomcat-servlet-3.0-api-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: tomcat-7.0.69-12.el7_3.noarch.rpm tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm tomcat-docs-webapp-7.0.69-12.el7_3.noarch.rpm tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-javadoc-7.0.69-12.el7_3.noarch.rpm tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-jsvc-7.0.69-12.el7_3.noarch.rpm tomcat-lib-7.0.69-12.el7_3.noarch.rpm tomcat-webapps-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: tomcat-7.0.69-12.el7_3.src.rpm noarch: tomcat-servlet-3.0-api-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): noarch: tomcat-7.0.69-12.el7_3.noarch.rpm tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm tomcat-docs-webapp-7.0.69-12.el7_3.noarch.rpm tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-javadoc-7.0.69-12.el7_3.noarch.rpm tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-jsvc-7.0.69-12.el7_3.noarch.rpm tomcat-lib-7.0.69-12.el7_3.noarch.rpm tomcat-webapps-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux Server (v. 7): Source: tomcat-7.0.69-12.el7_3.src.rpm noarch: tomcat-7.0.69-12.el7_3.noarch.rpm tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-lib-7.0.69-12.el7_3.noarch.rpm tomcat-servlet-3.0-api-7.0.69-12.el7_3.noarch.rpm tomcat-webapps-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux Server Optional (v. 7): noarch: tomcat-7.0.69-12.el7_3.noarch.rpm tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm tomcat-docs-webapp-7.0.69-12.el7_3.noarch.rpm tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-javadoc-7.0.69-12.el7_3.noarch.rpm tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-jsvc-7.0.69-12.el7_3.noarch.rpm tomcat-lib-7.0.69-12.el7_3.noarch.rpm tomcat-webapps-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: tomcat-7.0.69-12.el7_3.src.rpm noarch: tomcat-7.0.69-12.el7_3.noarch.rpm tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm tomcat-lib-7.0.69-12.el7_3.noarch.rpm tomcat-servlet-3.0-api-7.0.69-12.el7_3.noarch.rpm tomcat-webapps-7.0.69-12.el7_3.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: tomcat-docs-webapp-7.0.69-12.el7_3.noarch.rpm tomcat-javadoc-7.0.69-12.el7_3.noarch.rpm tomcat-jsvc-7.0.69-12.el7_3.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-5648 https://access.redhat.com/security/cve/CVE-2017-5664 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZeYTJXlSAg2UNWIIRAiRLAJ9mLApI6LC2N8mfgxyqv7Ndu04maACfaPeM /dGPQXHuX1omxWSQ/miLBj8= =Ia1W -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . The References section of this erratum contains a download link (you must log in to download the update). Security Fix(es): * It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

Configuration Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2024-11-20T20:48:34.052000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE