Apache Tomcat May Ignore @ServletSecurity Annotation Protections
|
|
SecurityTracker Alert ID: 1025215 |
|
SecurityTracker URL: http://securitytracker.com/id/1025215
|
|
CVE Reference:
CVE-2011-1088, CVE-2011-1183, CVE-2011-1582
(Links to External Site)
|
Updated: May 20 2011
|
Original Entry Date: Mar 15 2011
|
Impact:
Disclosure of user information, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.0.0 to 7.0.13
|
Description:
A vulnerability was reported in Apache Tomcat. A remote user may be able to bypass certain security protections.
The system ignores @ServletSecurity annotations when starting a web application. As a result, some areas of the application not receive the expected protection.
|
Impact:
A remote user may be able to bypass @ServletSecurity annotation protections.
|
Solution:
The vendor has issued a fix (7.0.14).
The vendor's original fixes (7.0.11 and 7.0.12) contained flaws [CVE-2011-1183 and CVE-2011-1582].
The vendor's original advisories are available at:
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.11_(released_11_Mar_2011)
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.12_(released_6_Apr_2011)
The vendor's advisory is available at:
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_(released_12_May_2011)
|
Vendor URL: tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_(released_12_May_2011) (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 15 Mar 2011 08:45:26 +0000
Subject: [SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2011-1088 Apache Tomcat security constraint bypass
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.10
- - Earlier versions are not affected
Description:
When a web application was started, @ServletSecurity annotations were
ignored. This meant that some areas of the application may not have been
protected as expected.
Mitigation:
Users of affected versions should apply one of the following mitigations:
- - Upgrade to a Tomcat version where this issue is fixed
- - Define security constraints via an alternative mechanism such as web.xml
Credit:
This issue was reported publicly on the Tomcat users mailing list.
The Apache Tomcat security requests that security vulnerability reports
are made privately to security@tomcat.apache.org in the first instance.
References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJNfycmAAoJEBDAHFovYFnn3jgP/0aecIt4uUYHWbmzUPA0FNan
tzjVfPskwPYrSuNbHjHuxPknmxUPSFiCdO3V1LLtnCX2y5+cNancWRjLX7lDbt8H
sL+9AaoI8HDShG1wgYsnh/3fIKczhE28pTtyo0GtG4HpQVLcT/OH2Qhb6+mG3jwo
SCia1eSTJuhj5HM3n2fb5X33n/UEkX/cCALDrt1DRfKV69MaZbMiZh7XfpyVDpdN
LePYIeuOoxg9CVjkDYCVIaK5Bi0uzPD8yCc73dOU3YobgbDDaLSN7Awd1/RhO5TR
fpWVbl0gbmMlPnMy52B9qZL+H9HwcNnYPqbtpquE2a6ik29QT4LMTNo0mr25XxmP
K3Jb7VTcVb/P1pxFOsTyMWy25IFubMEBW4c3kafBZGUI3Q25QmNizBXZ5wvn1vex
kBzDZrnKmkzvhnCy6RnTKk9BYGRWEw9ImTqLOaLxmtXJw9bnWgoeusnje1k/24QI
3+pw/g5OjwG7hqtStrscFeo8tc/snXBojn1d21txsnLggQ0E6+9+vUVym5tBD16I
MfzN7FSd620AFSmVUo5mEfEpDe+RTkA8y/7BnYHoguBQ7WLlxejCgRpaf91vBns6
ZEQGntzx7EW7M+P2GNHy1mrVGTQ7Glk/5tnAFyqgMOHzYyN11Y3OWO1XBv+1um8q
kadENSXz4mY0vKtvaeuT
=i/HJ
-----END PGP SIGNATURE-----
|
|
