Security update for tomcat6 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0839-1 Final 1 1 2016-03-21T09:27:05Z current 2016-03-21T09:27:05Z 2016-03-21T09:27:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tomcat6 This update for tomcat6 fixes the following issues: The version was updated from 6.0.41 to 6.0.45. Security issues fixed: * CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (bsc#967967) * CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects before considering security constraints and Filters, which allowed remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (bsc#967965) * CVE-2016-0706: Apache Tomcat did not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. (bsc#967815) * CVE-2016-0714: The session-persistence implementation in Apache Tomcat mishandled session attributes, which allowed remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. (bsc#967964) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-tomcat6-12465 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160839-1/ Link for SUSE-SU-2016:0839-1 https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html E-Mail link for SUSE-SU-2016:0839-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/934219 SUSE Bug 934219 https://bugzilla.suse.com/967815 SUSE Bug 967815 https://bugzilla.suse.com/967964 SUSE Bug 967964 https://bugzilla.suse.com/967965 SUSE Bug 967965 https://bugzilla.suse.com/967967 SUSE Bug 967967 https://www.suse.com/security/cve/CVE-2015-5174/ SUSE CVE CVE-2015-5174 page https://www.suse.com/security/cve/CVE-2015-5345/ SUSE CVE CVE-2015-5345 page https://www.suse.com/security/cve/CVE-2016-0706/ SUSE CVE CVE-2016-0706 page https://www.suse.com/security/cve/CVE-2016-0714/ SUSE CVE CVE-2016-0714 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-6.0.45-0.50.1 tomcat6-admin-webapps-6.0.45-0.50.1 tomcat6-docs-webapp-6.0.45-0.50.1 tomcat6-javadoc-6.0.45-0.50.1 tomcat6-jsp-2_1-api-6.0.45-0.50.1 tomcat6-lib-6.0.45-0.50.1 tomcat6-servlet-2_5-api-6.0.45-0.50.1 tomcat6-webapps-6.0.45-0.50.1 tomcat6-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-admin-webapps-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-docs-webapp-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-javadoc-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-jsp-2_1-api-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-lib-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-servlet-2_5-api-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-webapps-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-admin-webapps-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-docs-webapp-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-javadoc-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-jsp-2_1-api-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-lib-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-servlet-2_5-api-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tomcat6-webapps-6.0.45-0.50.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. CVE-2015-5174 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.45-0.50.1 moderate 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160839-1/ https://www.suse.com/security/cve/CVE-2015-5174.html CVE-2015-5174 https://bugzilla.suse.com/967967 SUSE Bug 967967 The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. CVE-2015-5345 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.45-0.50.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160839-1/ https://www.suse.com/security/cve/CVE-2015-5345.html CVE-2015-5345 https://bugzilla.suse.com/967965 SUSE Bug 967965 Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. CVE-2016-0706 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.45-0.50.1 low 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160839-1/ https://www.suse.com/security/cve/CVE-2016-0706.html CVE-2016-0706 https://bugzilla.suse.com/967815 SUSE Bug 967815 https://bugzilla.suse.com/971085 SUSE Bug 971085 https://bugzilla.suse.com/988489 SUSE Bug 988489 The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. CVE-2016-0714 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-admin-webapps-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-docs-webapp-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-javadoc-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-jsp-2_1-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-lib-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-servlet-2_5-api-6.0.45-0.50.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tomcat6-webapps-6.0.45-0.50.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160839-1/ https://www.suse.com/security/cve/CVE-2016-0714.html CVE-2016-0714 https://bugzilla.suse.com/967964 SUSE Bug 967964 https://bugzilla.suse.com/971085 SUSE Bug 971085