Ubuntu 11.10 USN-1252-1 Critical: Tomcat Authentication Issue

ubuntu

November 8, 2011

Tomcat could be made to crash or expose sensitive information over the network.

Summary

Tomcat could be made to crash or expose sensitive information over the

network.

Software Description:

- tomcat6: Servlet and JSP engine

Details:

It was discovered that Tomcat incorrectly implemented HTTP DIGEST

authentication. An attacker could use this flaw to perform a variety of

authentication attacks. (CVE-2011-1184)

Polina Genova discovered that Tomcat incorrectly created log entries with

passwords when encountering errors during JMX user creation. A local

attacker could possibly use this flaw to obtain sensitive information. This

issue only affected Ubuntu 10.04 LTS, 10.10 and 11.04. (CVE-2011-2204)

It was discovered that Tomcat incorrectly validated certain request

attributes when sendfile is enabled. A local attacker could bypass intended

restrictions, or cause the JVM to crash, resulting in a denial of service.

(CVE-2011-2526)

It was discovered that Tomcat incorrectly handled certain AJP requests. A

remote attacker could use this flaw to spoof...

Read the Full Advisory

Topics Covered

security advisory critical DoS Ubuntu authentication issue Tomcat

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libtomcat6-java                 6.0.32-5ubuntu1.1

Ubuntu 11.04:
  libtomcat6-java                 6.0.28-10ubuntu2.2

Ubuntu 10.10:
  libtomcat6-java                 6.0.28-2ubuntu1.5

Ubuntu 10.04 LTS:
  libtomcat6-java                 6.0.24-2ubuntu1.9

In general, a standard system update will make all the necessary changes.