Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Ubuntu 12.04 LTS USN-2655-1: Critical Tomcat Denial of Service Issues

ubuntu
Calendar Grey June 25, 2015
Dist Ubuntu Esm H88
Several vulnerabilities in Tomcat addressed in Ubuntu Security Notification USN-2655-1, concerning potential denial of service and request smuggling threats.
Several security issues were fixed in Tomcat.

Summary

Several security issues were fixed in Tomcat.

Software Description:

- tomcat6: Servlet and JSP engine

Details:

It was discovered that Tomcat incorrectly handled data with malformed

chunked transfer coding. A remote attacker could possibly use this issue to

conduct HTTP request smuggling attacks, or cause Tomcat to consume

resources, resulting in a denial of service. (CVE-2014-0227)

It was discovered that Tomcat incorrectly handled HTTP responses occurring

before the entire request body was finished being read. A remote attacker

could possibly use this issue to cause memory consumption, resulting in a

denial of service. (CVE-2014-0230)

It was discovered that the Tomcat Expression Language (EL) implementation

incorrectly handled accessible interfaces implemented by inaccessible

classes. An attacker could possibly use this issue to bypass a

SecurityManager protection mechanism. (CVE-2014-7810)

Topics%20covered

Topics Covered

security advisory denial of service tomcat ubuntu request smuggling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libtomcat6-java                 6.0.35-1ubuntu3.6

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2655-1

CVE-2014-0227, CVE-2014-0230, CVE-2014-7810

Severity
critical
Lowest
Low
Medium
High
Critical

June 25, 2015

Topics%20covered

Topics Covered

security advisory denial of service tomcat ubuntu request smuggling

Package Information

https://launchpad.net/ubuntu/+source/tomcat6/6.0.35-1ubuntu3.6

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.