Ubuntu 11.10 USN-1359-1 Critical: Tomcat Denial Of Service

ubuntu

February 13, 2012

Tomcat could be made to crash or expose sensitive information if it received specially crafted network traffic.

Summary

Tomcat could be made to crash or expose sensitive information if it

received specially crafted network traffic.

Software Description:

- tomcat6: Servlet and JSP engine

Details:

It was discovered that Tomcat incorrectly performed certain caching and

recycling operations. A remote attacker could use this flaw to obtain read

access to IP address and HTTP header information in certain cases. This

issue only applied to Ubuntu 11.10. (CVE-2011-3375)

It was discovered that Tomcat computed hash values for form parameters

without restricting the ability to trigger hash collisions predictably.

A remote attacker could cause a denial of service by sending many crafted

parameters. (CVE-2011-4858)

It was discovered that Tomcat incorrectly handled parameters. A remote

attacker could cause a denial of service by sending requests with a large

number of parameters and values. (CVE-2012-0022)

Topics Covered

security advisory denial of service information exposure tomcat ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libtomcat6-java                 6.0.32-5ubuntu1.2

Ubuntu 11.04:
  libtomcat6-java                 6.0.28-10ubuntu2.3

Ubuntu 10.10:
  libtomcat6-java                 6.0.28-2ubuntu1.6

Ubuntu 10.04 LTS:
  libtomcat6-java                 6.0.24-2ubuntu1.10

In general, a standard system update will make all the necessary changes.