(Red Hat Issues Fix) Tomcat RequestDispatcher Bug Lets Remote Users Bypass Access Restrictions
|
|
SecurityTracker Alert ID: 1020982 |
|
SecurityTracker URL: http://securitytracker.com/id/1020982
|
|
CVE Reference:
CVE-2008-2370
(Links to External Site)
|
Date: Oct 3 2008
|
Impact:
Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 4.1.0 to 4.1.37, 5.5.0 to 5.5.26, 6.0.0 to 6.0.16
|
Description:
A vulnerability was reported in Tomcat. A remote user can bypass certain access restriction.
When a RequestDispatcher is used, a remote user can submit a specially crafted request to access content that is ostensibly protected by a security constraint or by its location under the WEB-INF directory.
Stefano Di Paola of Minded Security Research Labs reported this vulnerability.
|
Impact:
A remote user can bypass certain security restrictions to access content that is ostensibly protected.
|
Solution:
Red Hat has released a fix for Red Hat Developer Suite.
The Red Hat advisory is available at:
https://rhn.redhat.com/errata/RHSA-2008-0864.html
|
Vendor URL: tomcat.apache.org/security.html (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 2 Oct 2008 10:19:35 -0400
Subject: [RHSA-2008:0864-02] Important: tomcat security update
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: tomcat security update
Advisory ID: RHSA-2008:0864-02
Product: Red Hat Developer Suite v.3
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0864.html
Issue date: 2008-10-02
Keywords: Security
CVE Names: CVE-2008-1232 CVE-2008-1947 CVE-2008-2370
CVE-2008-2938
=====================================================================
1. Summary:
Updated tomcat packages that fix multiple security issues are now available
for Red Hat Developer Suite 3.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Developer Suite v.3 (AS v.4) - noarch
3. Description:
Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.
A cross-site scripting vulnerability was discovered in the
HttpServletResponse.sendError() method. A remote attacker could inject
arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232)
An additional cross-site scripting vulnerability was discovered in the host
manager application. A remote attacker could inject arbitrary web script or
HTML via the hostname parameter. (CVE-2008-1947)
A traversal vulnerability was discovered when using a RequestDispatcher
in combination with a servlet or JSP. A remote attacker could utilize a
specially-crafted request parameter to access protected web resources.
(CVE-2008-2370)
An additional traversal vulnerability was discovered when the
"allowLinking" and "URIencoding" settings were activated. A remote attacker
could use a UTF-8-encoded request to extend their privileges and obtain
local files accessible to the Tomcat process. (CVE-2008-2938)
Users of tomcat should upgrade to these updated packages, which contain
backported patches to resolve these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bugs fixed (http://bugzilla.redhat.com/):
446393 - CVE-2008-1947 Tomcat host manager xss - name field
456120 - CVE-2008-2938 tomcat Unicode directory traversal vulnerability
457597 - CVE-2008-1232 tomcat: Cross-Site-Scripting enabled by sendError call
457934 - CVE-2008-2370 tomcat RequestDispatcher information disclosure vulnerability
6. Package List:
Red Hat Developer Suite v.3 (AS v.4):
Source:
ftp://updates.redhat.com/enterprise/4AS/en/RHDS3/SRPMS/tomcat5-5.5.23-0jpp_12rh.src.rpm
noarch:
tomcat5-5.5.23-0jpp_12rh.noarch.rpm
tomcat5-common-lib-5.5.23-0jpp_12rh.noarch.rpm
tomcat5-jasper-5.5.23-0jpp_12rh.noarch.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp_12rh.noarch.rpm
tomcat5-server-lib-5.5.23-0jpp_12rh.noarch.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp_12rh.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1947
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938
http://tomcat.apache.org/security-5.html
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFI5Nf8XlSAg2UNWIIRAsG5AJ42/G+9f8PMTm34X13mhK6wjTFy5wCfYngY
Hm8J+289xvTLIXJh2pXauvc=
=F+LH
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
