Ubuntu 12.04 LTS USN-1637-1 Moderate: Tomcat Denial Of Service

ubuntu

November 21, 2012

Several security issues were fixed in Apache Tomcat.

Summary

Several security issues were fixed in Apache Tomcat.

Software Description:

- tomcat6: Servlet and JSP engine

Details:

It was discovered that the Apache Tomcat HTTP NIO connector incorrectly

handled header data. A remote attacker could cause a denial of service by

sending requests with a large amount of header data. (CVE-2012-2733)

It was discovered that Apache Tomcat incorrectly handled DIGEST

authentication. A remote attacker could possibly use these flaws to perform

a replay attack and bypass authentication. (CVE-2012-5885, CVE-2012-5886,

CVE-2012-5887)

Topics Covered

security advisory denial of service apache update instructions tomcat ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libtomcat6-java                 6.0.35-1ubuntu3.1

Ubuntu 11.10:
  libtomcat6-java                 6.0.32-5ubuntu1.3

Ubuntu 10.04 LTS:
  libtomcat6-java                 6.0.24-2ubuntu1.11

In general, a standard system update will make all the necessary changes.