Ubuntu 16.04 LTS: USN-3177-1 Moderate: Tomcat Multiple Security Flaws

ubuntu

January 23, 2017

Several security issues were fixed in Tomcat.

Summary

Several security issues were fixed in Tomcat.

Software Description:

- tomcat8: Servlet and JSP engine

- tomcat7: Servlet and JSP engine

- tomcat6: Servlet and JSP engine

Details:

It was discovered that the Tomcat realm implementations incorrectly handled

passwords when a username didn't exist. A remote attacker could possibly

use this issue to enumerate usernames. This issue only applied to Ubuntu

12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)

Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly

limited use of a certain utility method. A malicious application could

possibly use this to bypass Security Manager restrictions. This issue only

applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.

(CVE-2016-5018)

It was discovered that Tomcat did not protect applications from untrusted

data in the HTTP_PROXY environment variable. A remote attacker could

possibly use this issue to redirect outbound traffic to an ...

Read the Full Advisory

Topics Covered

security advisory update remote access Ubuntu authentication bypass Tomcat

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  libtomcat8-java                 8.0.37-1ubuntu0.1
  tomcat8                         8.0.37-1ubuntu0.1

Ubuntu 16.04 LTS:
  libtomcat8-java                 8.0.32-1ubuntu1.3
  tomcat8                         8.0.32-1ubuntu1.3

Ubuntu 14.04 LTS:
  libtomcat7-java                 7.0.52-1ubuntu0.8
  tomcat7                         7.0.52-1ubuntu0.8

Ubuntu 12.04 LTS:
  libtomcat6-java                 6.0.35-1ubuntu3.9
  tomcat6                         6.0.35-1ubuntu3.9

In general, a standard system update will make all the necessary changes.