Security update for tomcat6 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1565-1 Final 1 1 2015-09-11T01:45:16Z current 2015-09-11T01:45:16Z 2015-09-11T01:45:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tomcat6 This update for Tomcat fixes the following security issues: - CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442) It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could have used this flaw to bypass security manager protections. - CVE-2014-0227: Limited DoS in chunked transfer encoding input filter. (bsc#917127) It was discovered that the ChunkedInputFilter implementation did not fail subsequent attempts to read input early enough. A remote attacker could have used this flaw to perform a denial of service attack, by streaming an unlimited quantity of data, leading to consumption of server resources. - CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an upload It was possible for a remote attacker to trigger a non-persistent DoS attack by feeding data by aborting an upload. (bsc#926762) Additionally, the following non-security issues have been fixed: - Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152) - Don't overwrite /var/run/tomcat6.pid when Tomcat is already running. (bsc#934219) - Miscellaneous fixes and improvements to Tomcat's init script. (bsc#932698) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-tomcat6-12092 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151565-1/ Link for SUSE-SU-2015:1565-1 https://lists.suse.com/pipermail/sle-security-updates/2015-September/001594.html E-Mail link for SUSE-SU-2015:1565-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/906152 SUSE Bug 906152 https://bugzilla.suse.com/917127 SUSE Bug 917127 https://bugzilla.suse.com/926762 SUSE Bug 926762 https://bugzilla.suse.com/931442 SUSE Bug 931442 https://bugzilla.suse.com/932698 SUSE Bug 932698 https://bugzilla.suse.com/934219 SUSE Bug 934219 https://www.suse.com/security/cve/CVE-2014-0227/ SUSE CVE CVE-2014-0227 page https://www.suse.com/security/cve/CVE-2014-0230/ SUSE CVE CVE-2014-0230 page https://www.suse.com/security/cve/CVE-2014-7810/ SUSE CVE CVE-2014-7810 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-6.0.41-0.47.1 tomcat6-admin-webapps-6.0.41-0.47.1 tomcat6-docs-webapp-6.0.41-0.47.1 tomcat6-javadoc-6.0.41-0.47.1 tomcat6-jsp-2_1-api-6.0.41-0.47.1 tomcat6-lib-6.0.41-0.47.1 tomcat6-servlet-2_5-api-6.0.41-0.47.1 tomcat6-webapps-6.0.41-0.47.1 tomcat6-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-admin-webapps-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-docs-webapp-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-javadoc-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-jsp-2_1-api-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-lib-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-servlet-2_5-api-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-webapps-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-admin-webapps-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-docs-webapp-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-javadoc-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-jsp-2_1-api-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-lib-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-servlet-2_5-api-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-webapps-6.0.41-0.47.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. CVE-2014-0227 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.41-0.47.1 moderate 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151565-1/ https://www.suse.com/security/cve/CVE-2014-0227.html CVE-2014-0227 https://bugzilla.suse.com/917127 SUSE Bug 917127 https://bugzilla.suse.com/926762 SUSE Bug 926762 https://bugzilla.suse.com/988489 SUSE Bug 988489 Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts. CVE-2014-0230 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.41-0.47.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151565-1/ https://www.suse.com/security/cve/CVE-2014-0230.html CVE-2014-0230 https://bugzilla.suse.com/926762 SUSE Bug 926762 https://bugzilla.suse.com/988489 SUSE Bug 988489 The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation. CVE-2014-7810 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.47.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.47.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.41-0.47.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151565-1/ https://www.suse.com/security/cve/CVE-2014-7810.html CVE-2014-7810 https://bugzilla.suse.com/931442 SUSE Bug 931442