Ubuntu 14.04-10.04 LTS USN-2302-1 Severe: Tomcat Denial of Service

ubuntu

July 30, 2014

Several security issues were fixed in Tomcat.

Summary

Several security issues were fixed in Tomcat.

Software Description:

- tomcat7: Servlet and JSP engine

- tomcat6: Servlet and JSP engine

Details:

David Jorm discovered that Tomcat incorrectly handled certain requests

submitted using chunked transfer encoding. A remote attacker could use this

flaw to cause the Tomcat server to consume resources, resulting in a denial

of service. (CVE-2014-0075)

It was discovered that Tomcat did not properly restrict XSLT stylesheets.

An attacker could use this issue with a crafted web application to bypass

security-manager restrictions and read arbitrary files. (CVE-2014-0096)

It was discovered that Tomcat incorrectly handled certain Content-Length

headers. A remote attacker could use this flaw in configurations where

Tomcat is behind a reverse proxy to perform HTTP request smuggling attacks.

(CVE-2014-0099)

Topics Covered

security advisory denial of service tomcat ubuntu severe

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libtomcat7-java                 7.0.52-1ubuntu0.1

Ubuntu 12.04 LTS:
  libtomcat6-java                 6.0.35-1ubuntu3.5

Ubuntu 10.04 LTS:
  libtomcat6-java                 6.0.24-2ubuntu1.16

In general, a standard system update will make all the necessary changes.