It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

This release of Red Hat JBoss Enterprise Application Platform 6.4.14 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.13, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted. (CVE-2016-8657)

* It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. (CVE-2017-6056)

* It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack. (CVE-2016-6346)

Red Hat would like to thank Mikhail Egorov (Odin) for reporting the CVE-2016-6346 issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0827 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss     Application Server 7.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.14 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.13, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect     permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group     (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6     and earlier), the file is sourced by the jboss init script and its content executed with root privileges     when jboss service is started, stopped, or restarted. (CVE-2016-8657)

    * It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat     servlet and JSP engine may result in denial of service via an infinite loop. (CVE-2017-6056)

    * It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker     could use this flaw to launch a Denial of Service attack. (CVE-2016-6346)

    Red Hat would like to thank Mikhail Egorov (Odin) for reporting the     CVE-2016-6346 issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

This release of Red Hat JBoss Enterprise Application Platform 6.4.14 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.13, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted. (CVE-2016-8657)

* It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. (CVE-2017-6056)

* It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack. (CVE-2016-6346)

Red Hat would like to thank Mikhail Egorov (Odin) for reporting the CVE-2016-6346 issue.

An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

With this update, the jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 6.4.14.

Security Fix(es) :

* It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jboss init script and its content executed with root privileges when jboss service is started, stopped, or restarted. (CVE-2016-8657)

* It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. (CVE-2017-6056)

* It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack. (CVE-2016-6346)

Red Hat would like to thank Mikhail Egorov (Odin) for reporting the CVE-2016-6346 issue.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3204-1 advisory.

    It was discovered that Tomcat incorrectly handled certain HTTP requests. A remote attacker could possibly     use this issue to cause Tomcat to consume resources, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The update for tomcat7 issued as DLA-823-1 caused that the server could return HTTP 400 errors under certain circumstances. Updated packages are now available to correct this issue. For reference, the original advisory text follows.

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop.

For Debian 7 'Wheezy', these problems have been fixed in version 7.0.28-4+deb7u11.

We recommend that you upgrade your tomcat7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop.

ID	Name	Product	Family	Severity
112253	RHEL 7 : JBoss EAP (RHSA-2017:0828)	Nessus	Red Hat Local Security Checks	high
97933	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 6 (Important) (RHSA-2017:0827)	Nessus	Red Hat Local Security Checks	high
97932	RHEL 5 : JBoss EAP (RHSA-2017:0826)	Nessus	Red Hat Local Security Checks	high
97909	RHEL 6 : jboss-ec2-eap (RHSA-2017:0829)	Nessus	Red Hat Local Security Checks	high
97304	Ubuntu 14.04 LTS : Tomcat vulnerability (USN-3204-1)	Nessus	Ubuntu Local Security Checks	high
97150	Debian DLA-823-2 : tomcat7 regression update	Nessus	Debian Local Security Checks	high
97137	Debian DSA-3788-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	high
97136	Debian DSA-3787-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-6056

high

Tenable Plugins

high

high

high

high

high

high

high

high