Updated tomcat packages that fix multiple security issues are now available for Red Hat Application Server v2. Tomcat incorrectly handled "Accept-Language" headers that do not conform to RFC 2616. An attacker was able to perform cross-site scripting (XSS) attacks in certain applications. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: tomcat security update
Advisory ID:       RHSA-2007:0876-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:0876.html
Issue date:        2007-10-11
Updated on:        2007-10-11
Product:           Red Hat Application Server
CVE Names:         CVE-2007-1358 CVE-2007-2449 CVE-2007-2450 
                   CVE-2007-3382 CVE-2007-3385 CVE-2007-3386 
- ---------------------------------------------------------------------1. Summary:

Updated tomcat packages that fix multiple security issues are now available
for Red Hat Application Server v2. 

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Application Server v2 4AS - noarch
Red Hat Application Server v2 4ES - noarch
Red Hat Application Server v2 4WS - noarch

3. Problem description:

Tomcat is a servlet container for Java Servlet and Java Server Pages
technologies.

Tomcat incorrectly handled "Accept-Language" headers that do not conform to
RFC 2616. An attacker was able to perform cross-site scripting (XSS)
attacks in certain applications (CVE-2007-1358).

Some JSPs within the 'examples' web application did not escape user
provided data. If the JSP examples were accessible, this flaw could allow a
remote attacker to perform cross-site scripting attacks (CVE-2007-2449).

Note: it is recommended the 'examples' web application not be installed on
a production system.

The Manager and Host Manager web applications did not escape user provided
data. If a user is logged in to the Manager or Host Manager web
application, an attacker could perform a cross-site scripting attack
(CVE-2007-2450). 

Tomcat was found treating single quote characters -- ' -- as delimiters in
cookies. This could allow remote attackers to obtain sensitive information,
such as session IDs, for session hijacking attacks (CVE-2007-3382).

It was reported Tomcat did not properly handle the following character
sequence in a cookie: \" (a backslash followed by a double-quote). It was
possible remote attackers could use this failure to obtain sensitive
information, such as session IDs, for session hijacking attacks
(CVE-2007-3385).

A cross-site scripting (XSS) vulnerability existed in the Host Manager
Servlet. This allowed remote attackers to inject arbitrary HTML and web
script via crafted requests (CVE-2007-3386).

Users of Tomcat should update to these erratum packages, which contain
backported patches and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at

5. Bug IDs fixed (http://bugzilla.redhat.com/):

244803 - CVE-2007-1358 tomcat accept-language xss flaw
244804 - CVE-2007-2449 tomcat examples jsp XSS
244808 - CVE-2007-2450 tomcat host manager XSS
247972 - CVE-2007-3382 tomcat handling of cookies
247976 - CVE-2007-3385 tomcat handling of cookie values
247994 - CVE-2007-3386 tomcat host manager xss

6. RPMs required:

Red Hat Application Server v2 4AS:

SRPMS:
c8a9674009457794d5969b0a4db09888  tomcat5-5.5.23-0jpp_4rh.4.src.rpm

noarch:
92c991a50808cc48ff7538e3320cd146  tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
364a741ad7d232a9fe1cf3e183001520  tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
c7afc607c579c4db42bcc094df7b5498  tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
044ec1d57f92903b32c4dd3f97211ea4  tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
2790253849bae9be0960517cfd781c4c  tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
0d64bdd04f35659f0b425843bf4cfda2  tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
7b8448505ae5e74010fa8fb37084dd6e  tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
3397d6f2b3ed49fcaa5616fb3363c0ce  tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
8f28858bc131b40e9effdac8f0d445ad  tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
0ea67bc6674bbc1e6fc50809a6594d9b  tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
6ca13028e1547f3630aefcfd73a84424  tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm

Red Hat Application Server v2 4ES:

SRPMS:
c8a9674009457794d5969b0a4db09888  tomcat5-5.5.23-0jpp_4rh.4.src.rpm

noarch:
92c991a50808cc48ff7538e3320cd146  tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
364a741ad7d232a9fe1cf3e183001520  tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
c7afc607c579c4db42bcc094df7b5498  tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
044ec1d57f92903b32c4dd3f97211ea4  tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
2790253849bae9be0960517cfd781c4c  tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
0d64bdd04f35659f0b425843bf4cfda2  tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
7b8448505ae5e74010fa8fb37084dd6e  tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
3397d6f2b3ed49fcaa5616fb3363c0ce  tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
8f28858bc131b40e9effdac8f0d445ad  tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
0ea67bc6674bbc1e6fc50809a6594d9b  tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
6ca13028e1547f3630aefcfd73a84424  tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm

Red Hat Application Server v2 4WS:

SRPMS:
c8a9674009457794d5969b0a4db09888  tomcat5-5.5.23-0jpp_4rh.4.src.rpm

noarch:
92c991a50808cc48ff7538e3320cd146  tomcat5-5.5.23-0jpp_4rh.4.noarch.rpm
364a741ad7d232a9fe1cf3e183001520  tomcat5-admin-webapps-5.5.23-0jpp_4rh.4.noarch.rpm
c7afc607c579c4db42bcc094df7b5498  tomcat5-common-lib-5.5.23-0jpp_4rh.4.noarch.rpm
044ec1d57f92903b32c4dd3f97211ea4  tomcat5-jasper-5.5.23-0jpp_4rh.4.noarch.rpm
2790253849bae9be0960517cfd781c4c  tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
0d64bdd04f35659f0b425843bf4cfda2  tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.4.noarch.rpm
7b8448505ae5e74010fa8fb37084dd6e  tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
3397d6f2b3ed49fcaa5616fb3363c0ce  tomcat5-server-lib-5.5.23-0jpp_4rh.4.noarch.rpm
8f28858bc131b40e9effdac8f0d445ad  tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.4.noarch.rpm
0ea67bc6674bbc1e6fc50809a6594d9b  tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.4.noarch.rpm
6ca13028e1547f3630aefcfd73a84424  tomcat5-webapps-5.5.23-0jpp_4rh.4.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key#package

7. References:

https://www.cve.org/CVERecord?id=CVE-2007-1358
https://www.cve.org/CVERecord?id=CVE-2007-2449
https://www.cve.org/CVERecord?id=CVE-2007-2450
https://www.cve.org/CVERecord?id=CVE-2007-3382
https://www.cve.org/CVERecord?id=CVE-2007-3385
https://www.cve.org/CVERecord?id=CVE-2007-3386
https://tomcat.apache.org/security-5.html
https://access.redhat.com/security/updates/classification#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.