Security update for tomcat6

Announcement ID: SUSE-SU-2016:0839-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2015-5174 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE-2015-5345 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE-2016-0706 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE-2016-0714 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SLES for SAP Applications 11-SP4
  • SUSE Linux Enterprise Server 11 SP4

An update that solves four vulnerabilities and has one security fix can now be installed.

Description:

This update for tomcat6 fixes the following issues:

The version was updated from 6.0.41 to 6.0.45.

Security issues fixed:

  • CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (bsc#967967)
  • CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects before considering security constraints and Filters, which allowed remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (bsc#967965)
  • CVE-2016-0706: Apache Tomcat did not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. (bsc#967815)
  • CVE-2016-0714: The session-persistence implementation in Apache Tomcat mishandled session attributes, which allowed remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. (bsc#967964)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server 11 SP4
    zypper in -t patch slessp4-tomcat6-12465=1
  • SLES for SAP Applications 11-SP4
    zypper in -t patch slessp4-tomcat6-12465=1

Package List:

  • SUSE Linux Enterprise Server 11 SP4 (noarch)
    • tomcat6-webapps-6.0.45-0.50.1
    • tomcat6-servlet-2_5-api-6.0.45-0.50.1
    • tomcat6-lib-6.0.45-0.50.1
    • tomcat6-javadoc-6.0.45-0.50.1
    • tomcat6-jsp-2_1-api-6.0.45-0.50.1
    • tomcat6-admin-webapps-6.0.45-0.50.1
    • tomcat6-6.0.45-0.50.1
    • tomcat6-docs-webapp-6.0.45-0.50.1
  • SLES for SAP Applications 11-SP4 (noarch)
    • tomcat6-webapps-6.0.45-0.50.1
    • tomcat6-servlet-2_5-api-6.0.45-0.50.1
    • tomcat6-lib-6.0.45-0.50.1
    • tomcat6-javadoc-6.0.45-0.50.1
    • tomcat6-jsp-2_1-api-6.0.45-0.50.1
    • tomcat6-admin-webapps-6.0.45-0.50.1
    • tomcat6-6.0.45-0.50.1
    • tomcat6-docs-webapp-6.0.45-0.50.1

References: