Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter (CVE-2014-0227)

  - Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP     connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote     attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks     via (1) multiple Content-Length headers or (2) a Content-Length header and a Transfer-Encoding: chunked     header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. (CVE-2013-4286)

  - Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before     7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption)     via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
    (CVE-2014-0075)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2654-1 advisory.

    It was discovered that the Tomcat XML parser incorrectly handled XML External Entities (XXE). A remote     attacker could possibly use this issue to read arbitrary files. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-0119)

    It was discovered that Tomcat incorrectly handled data with malformed chunked transfer coding. A remote     attacker could possibly use this issue to conduct HTTP request smuggling attacks, or cause Tomcat to     consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-0227)

    It was discovered that Tomcat incorrectly handled HTTP responses occurring before the entire request body     was finished being read. A remote attacker could possibly use this issue to cause a limited denial of     service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0230)

    It was discovered that the Tomcat Expression Language (EL) implementation incorrectly handled accessible     interfaces implemented by inaccessible classes. An attacker could possibly use this issue to bypass a     SecurityManager protection mechanism. (CVE-2014-7810)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote IBM Storwize device is running a version that is 1.3.x prior to 1.4.3.4 or 1.5.x prior to 1.5.0.2. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Apache HTTP Server. A remote     attacker can exploit this, via partial HTTP requests,     to cause a daemon outage, resulting in a denial of     service condition. (CVE-2007-6750)

  - An HTTP request smuggling vulnerability exists due to a     flaw in the bundled version of Apache Tomcat; when an     HTTP connector or AJP connector is used, Tomcat fails to     properly handle certain inconsistent HTTP request     headers. A remote attacker can exploit this flaw, via     multiple Content-Length headers or a Content-Length     header and a 'Transfer-Encoding: chunked' header, to     smuggle an HTTP request in one or more Content-Length     headers. (CVE-2013-4286)

  - A denial of service vulnerability exists in the bundled     version of Apache Tomcat due to improper processing of     chunked transfer coding with a large amount of chunked     data or whitespace characters in an HTTP header value     within a trailer field. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2013-4322)

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Apache Tomcat; an integer     overflow condition exists in the parseChunkHeader()     function in ChunkedInputFilter.java. A remote attacker     can exploit this, via a malformed chunk size that is     part of a chunked request, to cause excessive     consumption of resources, resulting in a denial of     service condition. (CVE-2014-0075)

  - A remote code execution vulnerability exists due to a     flaw in the bundled version of Apache Struts. A remote     attacker can manipulate the ClassLoader via the class     parameter, resulting in the execution of arbitrary Java     code. (CVE-2014-0094)

  - An XML External Entity (XXE) injection vulnerability     exists due to a flaw in the bundled version of Apache     Tomcat; an incorrectly configured XML parser accepts     XML external entities from an untrusted source via XSLT.
    A remote attacker can exploit this, by sending specially     crafted XML data, to gain access to arbitrary files.
    (CVE-2014-0096)

  - An integer overflow condition exists in the bundled     version of Apache Tomcat. A remote attacker, via a     crafted Content-Length HTTP header, can conduct HTTP     request smuggling attacks. (CVE-2014-0099)

  - An information disclosure vulnerability exists due to a     flaw in the bundled version of Apache Tomcat. Tomcat     fails to properly constrain the class loader that     accesses the XML parser used with an XSLT stylesheet. A     remote attacker can exploit this, via a crafted web     application that provides an XML external entity     declaration in conjunction with an entity reference, to     read arbitrary files. (CVE-2014-0119)

  - A flaw exists in a bundled version of Samba due to a     flaw in the vfswrap_fsctl() function that is triggered     when responding to FSCTL_GET_SHADOW_COPY_DATA or     FSCTL_SRV_ENUMERATE_SNAPSHOTS client requests. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to disclose sensitive     information from process memory. (CVE-2014-0178)

  - Multiple flaws exist in the bundled version of Mozilla     Firefox that allow a remote attacker to execute     arbitrary code. (CVE-2014-1555, CVE-2014-1556,     CVE-2014-1557)

  - An information disclosure vulnerability exists due to     the chkauth password being saved in plaintext in the     audit log. A local attacker can exploit this to gain     administrator access. (CVE-2014-3077)

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Samba. An authenticated,     remote attacker can exploit this, via an attempt to read     a Unicode pathname without specifying the use of     Unicode, to cause an application crash. (CVE-2014-3493)   
  - A security bypass vulnerability exists due to an     unspecified flaw. A remote attacker can exploit this     flaw to reset the administrator password to its default     value via a direct request to the administrative IP     address. Note that this vulnerability only affects the     1.4.x release levels. (CVE-2014-4811)

Updated tomcat package fixes security vulnerabilities :

It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition (CVE-2014-0050).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request (CVE-2014-0227).

Updated tomcat6 packages fix security vulnerabilities :

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).

In Apache Tomcat 6.x before 6.0.55, it was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request (CVE-2014-0227).

Updated tomcat packages fix security vulnerabilities :

Apache Tomcat 7.x before 7.0.47, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a Transfer-Encoding: chunked header (CVE-2013-4286).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat internals information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header (CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or read files associated with different web applications on a single Tomcat instance via a crafted web application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request (CVE-2014-0227).

According to its self-reported version number, the instance of Apache Tomcat 8.0.x listening on the remote host is a version prior to 8.0.5.
It is, therefore, affected by an information disclosure vulnerability.
An error exists that allows undesired XML parsers to be injected into the application by a malicious web application, the bypassing security controls, and the processing of external XML entities.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - Integer overflow in the parseChunkHeader function in     java/org/apache/coyote/     http11/filters/ChunkedInputFilter.java in Apache Tomcat     before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4     allows remote attackers to cause a denial of service     (resource consumption) via a malformed chunk size in     chunked transfer coding of a request during the     streaming of data. (CVE-2014-0075)

  - java/org/apache/catalina/servlets/DefaultServlet.java in     the default servlet in Apache Tomcat before 6.0.40, 7.x     before 7.0.53, and 8.x before 8.0.4 does not properly     restrict XSLT stylesheets, which allows remote attackers     to bypass security-manager restrictions and read     arbitrary files via a crafted web application that     provides an XML external entity declaration in     conjunction with an entity reference, related to an XML     External Entity (XXE) issue. (CVE-2014-0096)

  - Integer overflow in     java/org/apache/tomcat/util/buf/Ascii.java in Apache     Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before     8.0.4, when operated behind a reverse proxy, allows     remote attackers to conduct HTTP request smuggling     attacks via a crafted Content-Length HTTP header.
    (CVE-2014-0099)

  - Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x     before 8.0.6 does not properly constrain the class     loader that accesses the XML parser used with an XSLT     stylesheet, which allows remote attackers to (1) read     arbitrary files via a crafted web application that     provides an XML external entity declaration in     conjunction with an entity reference, related to an XML     External Entity (XXE) issue, or (2) read files     associated with different web applications on a single     Tomcat instance via a crafted web application.
    (CVE-2014-0119)

The remote host is affected by the vulnerability described in GLSA-201412-29 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tomcat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition as       well as obtain sensitive information, bypass protection mechanisms and       authentication restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Oracle Enterprise Data Quality running on the remote host is affected by multiple vulnerabilities :

  - A flaw in Apache Commons BeanUtils allows a remote     attacker to execute arbitrary code by manipulating the     ClassLoader. (CVE-2014-0114)

  - A flaw in Apache Tomcat allows a remote attacker to     replace the XML parsers and thereby gain access to     sensitive information. (CVE-2014-0119)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1088 advisory.

  - tomcat: information disclosure via XXE when running untrusted web applications (CVE-2013-4590)

  - httpd: mod_deflate denial of service (CVE-2014-0118)

  - Tomcat/JBossWeb: XML parser hijack by malicious web application (CVE-2014-0119)

  - httpd: mod_status heap-based buffer overflow (CVE-2014-0226)

  - Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter (CVE-2014-0227)

  - httpd: mod_cgid denial of service (CVE-2014-0231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Red Hat JBoss Web Server 2.1.0, which fixes multiple security issues and several bugs, is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release serves as a replacement for Red Hat JBoss Web Server 2.0.1, and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0 Release Notes, linked to in the References section, for information on the most significant of these changes.

The following security issues are also fixed with this release :

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Tomcat instance. (CVE-2014-0119)

All users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 6 are advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server process must be restarted for this update to take effect.

Tomcat has been updated to version 6.0.41, which brings security and bug fixes.

The following security fixes have been fixed :

  - A XXE vulnerability via user-supplied XSLTs.
    (CVE-2014-0096)

  - Request smuggling via malicious content length header.
    (CVE-2014-0099)

  - A XML parser hijack by malicious web application. Bugs     fixed:. (CVE-2014-0119)

  - Socket bind fails on tomcat startup when using apr     (IPV6). (bnc#881700)

  - classpath for org/apache/juli/logging/LogFactory     (bnc#844689)

It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance.
(CVE-2014-0119)

Tomcat must be restarted for this update to take effect.

Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment. (CVE-2013-4590)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance.
(CVE-2014-0119)

All Tomcat users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1038 advisory.

    - Related: CVE-2013-4590  - remove xml schema names javaee_5,
    - Resolves: CVE-2014-0227
    - Related: CVE-2013-4590 incrementing release. added
    - Related: CVE-2013-4590 incrementing release
    - Resolves: CVE-2013-4590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tomcat packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance.
(CVE-2014-0119)

All Tomcat users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Tomcat must be restarted for this update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1034 advisory.

    - Resolves: CVE-2013-4590
    - Resolves: CVE-2014-0119
    - Related: CVE-2014-0099 incrementing release so rpmdiff doesn't complain about
    - Resolves: CVE-2014-0099 Fix possible overflow when parsing
    - Resolves: CVE-2014-0096 Information discloser process XSLT

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated Red Hat JBoss Enterprise Application Platform 6.2.4 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

It was discovered that JBoss Web did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web by streaming an unlimited quantity of data, leading to excessive consumption of server resources. (CVE-2014-0075)

It was found that JBoss Web did not check for overflowing values when parsing request content length headers. A remote attacker could use this flaw to perform an HTTP request smuggling attack on a JBoss Web server located behind a reverse proxy that processed the content length header correctly. (CVE-2014-0099)

It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. (CVE-2014-0096)

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web instance. (CVE-2014-0119)

The CVE-2014-0075 issue was discovered by David Jorm of Red Hat Product Security.

All users of Red Hat JBoss Enterprise Application Platform 6.2.4 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

The version of Tomcat installed on the remote host is prior to 8.0.8. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.0.8_security-8 advisory.

  - Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class     loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1)     read arbitrary files via a crafted web application that provides an XML external entity declaration in     conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files     associated with different web applications on a single Tomcat instance via a crafted web application.
    (CVE-2014-0119)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.54. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.54_security-7 advisory.

  - Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class     loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1)     read arbitrary files via a crafted web application that provides an XML external entity declaration in     conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files     associated with different web applications on a single Tomcat instance via a crafted web application.
    (CVE-2014-0119)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.40. It is, therefore, affected by the following vulnerabilities :

  - An error exists related to chunk size and chunked     requests that allows denial of service attacks.
    (CVE-2014-0075)

  - An error exists related to XSLT handling and security     managers that allows a security bypass related to     external XML entities. (CVE-2014-0096)

  - An error exists related to content length header     handling and using the application behind a reverse     proxy that allows a security bypass. (CVE-2014-0099)

  - An error exists that allows undesired XML parsers to be     injected into the application by a malicious web     application, allows the bypassing of security controls,     and allows the processing of external XML entities.
    (CVE-2014-0119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199943	RHEL 5 : others (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
90205	Debian DSA-3530-1 : tomcat6 - security update	Nessus	Debian Local Security Checks	high
84429	Ubuntu 14.04 LTS : Tomcat vulnerabilities (USN-2654-1)	Nessus	Ubuntu Local Security Checks	medium
84401	IBM Storwize 1.3.x < 1.4.3.4 / 1.5.x < 1.5.0.2 Multiple Vulnerabilities	Nessus	Misc.	high
82337	Mandriva Linux Security Advisory : tomcat (MDVSA-2015:084)	Nessus	Mandriva Local Security Checks	medium
81936	Mandriva Linux Security Advisory : tomcat6 (MDVSA-2015:053)	Nessus	Mandriva Local Security Checks	medium
81935	Mandriva Linux Security Advisory : tomcat (MDVSA-2015:052)	Nessus	Mandriva Local Security Checks	medium
8921	Apache Tomcat 7.0.x < 7.0.54 / 8.0.x < 8.0.8 XML Parser Information Disclosure	Nessus Network Monitor	Web Servers	medium
80794	Oracle Solaris Third-Party Patch Update : tomcat (cve_2014_0075_numeric_errors)	Nessus	Solaris Local Security Checks	medium
79982	GLSA-201412-29 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
78749	Oracle Enterprise Data Quality Multiple Vulnerabilities (October 2014 CPU)	Nessus	CGI abuses	high
77357	RHEL 5 : Red Hat JBoss Web Server 2.1.0 update (Important) (RHSA-2014:1088)	Nessus	Red Hat Local Security Checks	medium
77356	RHEL 6 : JBoss Web Server (RHSA-2014:1087)	Nessus	Red Hat Local Security Checks	medium
77197	SuSE 11.3 Security Update : tomcat6 (SAT Patch Number 9487)	Nessus	SuSE Local Security Checks	medium
77144	Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20140811)	Nessus	Scientific Linux Local Security Checks	medium
77141	RHEL 6 : tomcat6 (RHSA-2014:1038)	Nessus	Red Hat Local Security Checks	medium
77137	Oracle Linux 6 : tomcat6 (ELSA-2014-1038)	Nessus	Oracle Linux Local Security Checks	medium
77121	CentOS 6 : tomcat6 (CESA-2014:1038)	Nessus	CentOS Local Security Checks	medium
77082	RHEL 7 : tomcat (RHSA-2014:1034)	Nessus	Red Hat Local Security Checks	medium
77077	Oracle Linux 7 : tomcat (ELSA-2014-1034)	Nessus	Oracle Linux Local Security Checks	medium
77060	CentOS 7 : tomcat (CESA-2014:1034)	Nessus	CentOS Local Security Checks	medium
76401	RHEL 5 / 6 : JBoss EAP (RHSA-2014:0843)	Nessus	Red Hat Local Security Checks	medium
74249	Apache Tomcat 8.0.0-RC1 < 8.0.8	Nessus	Web Servers	medium
74247	Apache Tomcat 7.0.0 < 7.0.54	Nessus	Web Servers	medium
74245	Apache Tomcat 6.0.x < 6.0.40 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2014-0119

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium