Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - tomcat: security manager bypass via IntrospectHelper utility function (CVE-2016-5018)

  - tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer     coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in     an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by     streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
    (CVE-2013-4322)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 8.0.0-RC10. It is, therefore, affected by multiple vulnerabilities:

  - The fix for CVE-2012-3544 was not complete and limits     are not properly applied to chunk extensions and     whitespaces in certain trailing headers. This error     could allow denial of service attacks. (CVE-2013-4322)

  - The application allows XML External Entity (XXE)     processing that could disclose sensitive information.
    (CVE-2013-4590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation.

Updated tomcat package fixes security vulnerabilities :

It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition (CVE-2014-0050).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request (CVE-2014-0227).

Updated tomcat packages fix security vulnerabilities :

Apache Tomcat 7.x before 7.0.47, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a Transfer-Encoding: chunked header (CVE-2013-4286).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request (CVE-2014-0227).

The remote Solaris system is missing necessary patches to address security updates :

  - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30     does not properly handle chunk extensions in chunked     transfer coding, which allows remote attackers to cause     a denial of service by streaming data. (CVE-2012-3544)

  - Unspecified vulnerability in the Javadoc component in     Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and     earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21     and earlier; and OpenJDK 7 allows remote attackers to     affect integrity via unknown vectors related to Javadoc.
    NOTE: the previous information is from the June 2013     CPU. Oracle has not commented on claims from another     vendor that this issue is related to frame injection in     HTML that is generated by Javadoc. (CVE-2013-1571)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x     before 8.0.0-RC3, when an HTTP connector or AJP     connector is used, does not properly handle certain     inconsistent HTTP request headers, which allows remote     attackers to trigger incorrect identification of a     request's length and conduct request-smuggling attacks     via (1) multiple Content-Length headers or (2) a     Content-Length header and a 'Transfer-Encoding: chunked'     header. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2005-2090. (CVE-2013-4286)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x     before 8.0.0-RC10 processes chunked transfer coding     without properly handling (1) a large total amount of     chunked data or (2) whitespace characters in an HTTP     header value within a trailer field, which allows remote     attackers to cause a denial of service by streaming     data. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-3544. (CVE-2013-4322)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x     before 8.0.0-RC10 allows attackers to obtain 'Tomcat     internals' information by leveraging the presence of an     untrusted web application with a context.xml, web.xml,

    *.jspx, *.tagx, or *.tld XML document containing an     external entity declaration in conjunction with an     entity reference, related to an XML External Entity     (XXE) issue. (CVE-2013-4590)

  - org/apache/catalina/connector/CoyoteAdapter.java in     Apache Tomcat 6.0.33 through 6.0.37 does not consider     the disableURLRewriting setting when handling a session     ID in a URL, which allows remote attackers to conduct     session fixation attacks via a crafted URL.
    (CVE-2014-0033)

The remote host is affected by the vulnerability described in GLSA-201412-29 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tomcat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition as       well as obtain sensitive information, bypass protection mechanisms and       authentication restrictions.
  Workaround :

    There is no known workaround at this time.

- Updated to 7.0.52

    - Create and own %{_localstatedir}/lib/tomcats,       resolves: rhbz#1026741

    - Add pom for tomcat-jdbc, resolves: rhbz#1011003

    - Substitute libnames in catalina-tasks.xml, resolves:
      rhbz#1126439

    - Use CATALINA_OPTS only on start, resolves:
      rhbz#1051194

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2.
It is, therefore, affected by multiple vulnerabilities in third party libraries :

  - The bundled version of Apache Struts contains a code     execution flaw. Note that 5.0 Update 3c only addresses     this vulnerability. (CVE-2014-0114)

  - The bundled tc-server / Apache Tomcat contains multiple     vulnerabilities. (CVE-2013-4590, CVE-2013-4322, and     CVE-2014-0050)

  - The bundled version of Oracle JRE is prior to 1.7.0_55     and thus is affected by multiple vulnerabilities. Note     that this only affects version 5.5 of vCenter.

a. vCenter Server Apache Struts Update

   The Apache Struts library is updated to address a security issue.  

   This issue may lead to remote code execution after authentication.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifier CVE-2014-0114 to this issue.


b. vCenter Server tc-server 2.9.5 / Apache Tomcat 7.0.52 updates

   tc-server has been updated to version 2.9.5 to address multiple    security issues. This version of tc-server includes Apache Tomcat    7.0.52.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifiers CVE-2013-4590, CVE-2013-4322, and    CVE-2014-0050 to these issues. 

c. Update to ESXi glibc package

   glibc is updated to address multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifiers CVE-2013-0242 and CVE-2013-1914 to    these issues. 

d. vCenter and Update Manager, Oracle JRE 1.7 Update 55

   Oracle has documented the CVE identifiers that are addressed in    JRE 1.7.0 update 55 in the Oracle Java SE Critical Patch Update    Advisory of April 2014. The References section provides a link to    this advisory.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1088 advisory.

  - tomcat: information disclosure via XXE when running untrusted web applications (CVE-2013-4590)

  - httpd: mod_deflate denial of service (CVE-2014-0118)

  - Tomcat/JBossWeb: XML parser hijack by malicious web application (CVE-2014-0119)

  - httpd: mod_status heap-based buffer overflow (CVE-2014-0226)

  - Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter (CVE-2014-0227)

  - httpd: mod_cgid denial of service (CVE-2014-0231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and several bugs, is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release serves as a replacement for Red Hat JBoss Web Server 2.0.1, and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0 Release Notes, linked to in the References section, for information on the most significant of these changes.

The following security issues are also fixed with this release :

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Tomcat instance. (CVE-2014-0119)

All users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 6 are advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server process must be restarted for this update to take effect.

It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance.
(CVE-2014-0119)

Tomcat must be restarted for this update to take effect.

Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance.
(CVE-2014-0119)

All Tomcat users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1038 advisory.

    - Related: CVE-2013-4590  - remove xml schema names javaee_5,
    - Resolves: CVE-2014-0227
    - Related: CVE-2013-4590 incrementing release. added
    - Related: CVE-2013-4590 incrementing release
    - Resolves: CVE-2013-4590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.50. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.50_security-7 advisory.

  - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked     transfer coding, which allows remote attackers to cause a denial of service by streaming data.
    (CVE-2012-3544)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain     Tomcat internals information by leveraging the presence of an untrusted web application with a     context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in     conjunction with an entity reference, related to an XML External Entity (XXE) issue. (CVE-2013-4590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.39. It is, therefore, affected by the following vulnerabilities :

  - The version of Java used to build the application     generates Javadoc containing a frame injection error.
    (CVE-2013-1571)

  - The fix for CVE-2005-2090 was not complete and the     application does not reject requests with multiple     Content-Length HTTP headers or with Content-Length     HTTP headers when using chunked encoding.
    (CVE-2013-4286)

  - The fix for CVE-2012-3544 was not complete and limits     are not properly applied to chunk extensions and     whitespaces in certain trailing headers. This error     allows denial of service attacks. (CVE-2013-4322)

  - The application allows XML External Entity (XXE)     processing that discloses sensitive information.
    (CVE-2013-4590)

  - An error exists related to the 'disableURLRewriting'     configuration option and session IDs. (CVE-2014-0033)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198604	RHEL 5 : tomcat5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
121122	Apache Tomcat < 8.0.0-RC10 Multiple Vulnerabilities	Nessus	Web Servers	low
90205	Debian DSA-3530-1 : tomcat6 - security update	Nessus	Debian Local Security Checks	high
82337	Mandriva Linux Security Advisory : tomcat (MDVSA-2015:084)	Nessus	Mandriva Local Security Checks	medium
81935	Mandriva Linux Security Advisory : tomcat (MDVSA-2015:052)	Nessus	Mandriva Local Security Checks	medium
80793	Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_apache_tomcat4)	Nessus	Solaris Local Security Checks	medium
79982	GLSA-201412-29 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
77928	Fedora 20 : tomcat-7.0.52-1.fc20 (2014-11048)	Nessus	Fedora Local Security Checks	medium
77728	VMware Security Updates for vCenter Server (VMSA-2014-0008)	Nessus	Misc.	critical
77630	VMSA-2014-0008 : VMware vSphere product updates to third-party libraries	Nessus	VMware ESX Local Security Checks	high
77357	RHEL 5 : Red Hat JBoss Web Server 2.1.0 update (Important) (RHSA-2014:1088)	Nessus	Red Hat Local Security Checks	medium
77356	RHEL 6 : JBoss Web Server (RHSA-2014:1087)	Nessus	Red Hat Local Security Checks	medium
77144	Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20140811)	Nessus	Scientific Linux Local Security Checks	medium
77141	RHEL 6 : tomcat6 (RHSA-2014:1038)	Nessus	Red Hat Local Security Checks	medium
77137	Oracle Linux 6 : tomcat6 (ELSA-2014-1038)	Nessus	Oracle Linux Local Security Checks	medium
77121	CentOS 6 : tomcat6 (CESA-2014:1038)	Nessus	CentOS Local Security Checks	medium
72691	Apache Tomcat 7.0.0 < 7.0.50 multiple vulnerabilities	Nessus	Web Servers	medium
72690	Apache Tomcat 6.0.x < 6.0.39 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2013-4590

medium

Tenable Plugins

critical

low

high

medium

medium

medium

high

medium

critical

high

medium

medium

medium

medium

medium

medium

medium

medium