Detections
Analytics
RHEL 5 : tomcat (RHSA-2009:1164)
medium Nessus Plugin ID 40342
Synopsis
The remote Red Hat host is missing one or more security updates for tomcat.Description
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1164 advisory.Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
It was discovered that the Red Hat Security Advisory RHSA-2007:0871 did not address all possible flaws in the way Tomcat handles certain characters and character sequences in cookie values. A remote attacker could use this flaw to obtain sensitive information, such as session IDs, and then use this information for session hijacking attacks. (CVE-2007-5333)
Note: The fix for the CVE-2007-5333 flaw changes the default cookie processing behavior: with this update, version 0 cookies that contain values that must be quoted to be valid are automatically changed to version 1 cookies. To reactivate the previous, but insecure behavior, add the following entry to the /etc/tomcat5/catalina.properties file:
org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false
It was discovered that request dispatchers did not properly normalize user requests that have trailing query strings, allowing remote attackers to send specially-crafted requests that would cause an information leak.
(CVE-2008-5515)
A flaw was found in the way the Tomcat AJP (Apache JServ Protocol) connector processes AJP connections. An attacker could use this flaw to send specially-crafted requests that would cause a temporary denial of service. (CVE-2009-0033)
It was discovered that the error checking methods of certain authentication classes did not have sufficient error checking, allowing remote attackers to enumerate (via brute force methods) usernames registered with applications running on Tomcat when FORM-based authentication was used.
(CVE-2009-0580)
A cross-site scripting (XSS) flaw was found in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the time parameter.
(CVE-2009-0781)
It was discovered that web applications containing their own XML parsers could replace the XML parser Tomcat uses to parse configuration files. A malicious web application running on a Tomcat instance could read or, potentially, modify the configuration and XML-based data of other web applications deployed on the same Tomcat instance. (CVE-2009-0783)
Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the RHEL tomcat package based on the guidance in RHSA-2009:1164.See Also
http://tomcat.apache.org/security-5.html
http://www.nessus.org/u?a7a5f4ee
https://access.redhat.com/errata/RHSA-2009:1164
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=427766
https://bugzilla.redhat.com/show_bug.cgi?id=489028
https://bugzilla.redhat.com/show_bug.cgi?id=493381
https://bugzilla.redhat.com/show_bug.cgi?id=503978
Plugin Details
Severity: Medium
ID: 40342
File Name: redhat-RHSA-2009-1164.nasl
Version: 1.34
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 7/22/2009
Updated: 11/4/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.2
Vendor
Vendor Severity: Important
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2008-5515
CVSS v3
Risk Factor: Medium
Base Score: 4.2
Temporal Score: 3.9
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
CVSS Score Source: CVE-2009-0783
Vulnerability Information
CPE: cpe:/o:redhat:enterprise_linux:5, p-cpe:/a:redhat:enterprise_linux:tomcat5-jasper, p-cpe:/a:redhat:enterprise_linux:tomcat5-common-lib, p-cpe:/a:redhat:enterprise_linux:tomcat5-jsp-2.0-api, p-cpe:/a:redhat:enterprise_linux:tomcat5, p-cpe:/a:redhat:enterprise_linux:tomcat5-server-lib, p-cpe:/a:redhat:enterprise_linux:tomcat5-admin-webapps, p-cpe:/a:redhat:enterprise_linux:tomcat5-servlet-2.4-api, p-cpe:/a:redhat:enterprise_linux:tomcat5-jsp-2.0-api-javadoc, p-cpe:/a:redhat:enterprise_linux:tomcat5-servlet-2.4-api-javadoc, p-cpe:/a:redhat:enterprise_linux:tomcat5-webapps, p-cpe:/a:redhat:enterprise_linux:tomcat5-jasper-javadoc
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/21/2009
Vulnerability Publication Date: 2/11/2008
Reference Information
CVE: CVE-2007-5333, CVE-2008-5515, CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, CVE-2009-0783