Home / mailings [USN-3177-2] Tomcat regression
Posted on 02 February 2017
Ubuntu Security==========================
==========================
========================
Ubuntu Security Notice USN-3177-2
February 02, 2017
tomcat6, tomcat7 regression
==========================
==========================
========================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
USN-3177-1 introduced a regression in Tomcat.
Software Description:
- tomcat7: Servlet and JSP engine
- tomcat6: Servlet and JSP engine
Details:
USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a
regression in environments where Tomcat is started with a security manage=
r.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Tomcat realm implementations incorrectly hand=
led
passwords when a username didn't exist. A remote attacker could possibly=
use this issue to enumerate usernames. This issue only applied to Ubuntu=
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue on=
ly
applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-5018)
It was discovered that Tomcat did not protect applications from untrust=
ed
data in the HTTP_PROXY environment variable. A remote attacker could
possibly use this issue to redirect outbound traffic to an arbitrary pro=
xy
server. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS an=
d
Ubuntu 16.04 LTS. (CVE-2016-5388)
It was discovered that Tomcat incorrectly controlled reading system
properties. A malicious application could possibly use this to bypass
Security Manager restrictions. This issue only applied to Ubuntu 12.04 L=
TS,
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6794)
It was discovered that Tomcat incorrectly controlled certain configurat=
ion
parameters. A malicious application could possibly use this to bypass
Security Manager restrictions. This issue only applied to Ubuntu 12.04 L=
TS,
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6796)
It was discovered that Tomcat incorrectly limited access to global JNDI=
resources. A malicious application could use this to access any global J=
NDI
resource without an explicit ResourceLink. This issue only applied to
Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6797)=
Regis Leroy discovered that Tomcat incorrectly filtered certain invalid=
characters from the HTTP request line. A remote attacker could possibly
use this issue to inject data into HTTP responses. (CVE-2016-6816)
Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did =
not
implement a recommended fix. A remote attacker could possibly use this
issue to execute arbitrary code. (CVE-2016-8735)
It was discovered that Tomcat incorrectly handled error handling in the=
send file code. A remote attacker could possibly use this issue to acces=
s
information from other requests. (CVE-2016-8745)
Paul Szabo discovered that the Tomcat package incorrectly handled upgra=
des
and removals. A local attacker could possibly use this issue to obtain
root privileges. (CVE-2016-9774, CVE-2016-9775)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libtomcat7-java 7.0.52-1ubuntu0.9
tomcat7 7.0.52-1ubuntu0.9
Ubuntu 12.04 LTS:
libtomcat6-java 6.0.35-1ubuntu3.10
tomcat6 6.0.35-1ubuntu3.10
In general, a standard system update will make all the necessary changes.=
References:
http://www.ubuntu.com/usn/usn-3177-2
http://www.ubuntu.com/usn/usn-3177-1
https://launchpad.net/bugs/1659589
Package Information:
https://launchpad.net/ubuntu/+source/tomcat7/7.0.52-1ubuntu0.9
https://launchpad.net/ubuntu/+source/tomcat6/6.0.35-1ubuntu3.10
--bIgdpJXjv4PrNFLsHqQMSRglLxeEEdJ6t--
