SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Red Hat JBoss Vendors:   Red Hat
(Red Hat Issues Fix for JBoss) Apache Tomcat Request Processing Lets Remote Users Deny Service
SecurityTracker Alert ID:  1033293
SecurityTracker URL:  http://securitytracker.com/id/1033293
CVE Reference:   CVE-2014-0230   (Links to External Site)
Date:  Aug 14 2015
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in Apache Tomcat. A remote user can cause denial of service conditions on the target system. JBoss is affected.

A remote user can send a specially crafted request to temporarily consume excessive CPU resources on the target system.

AntBean@secdig from the Baidu Security Team reported this vulnerability.

Impact:   A remote user can consume excessive memory on the target system.
Solution:   Red Hat has issued a fix for JBoss.

The Red Hat advisories are available at:

https://rhn.redhat.com/errata/RHSA-2015-1621.html
https://rhn.redhat.com/errata/RHSA-2015-1622.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2015-1621.html (Links to External Site)
Cause:   Resource error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  5, 6, 7

Message History:   This archive entry is a follow-up to the message listed below.
Apr 11 2015 Apache Tomcat Request Processing Lets Remote Users Deny Service



 Source Message Contents

Subject:  [RHSA-2015:1621-01] Moderate: Red Hat JBoss Web Server 2.1.0 tomcat security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Web Server 2.1.0 tomcat security update
Advisory ID:       RHSA-2015:1621-01
Product:           Red Hat JBoss Web Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2015-1621.html
Issue date:        2015-08-13
CVE Names:         CVE-2014-0230 CVE-2014-7810 
=====================================================================

1. Summary:

An update for the Apache Tomcat 6 and Apache Tomcat 7 component for Red Hat
JBoss Web Server 2.1.0 that fixes two security issues is now available from
the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

It was found that the expression language resolver evaluated expressions
within a privileged code section. A malicious web application could use
this flaw to bypass security manager protections. (CVE-2014-7810)

It was found that Tomcat would keep connections open after processing
requests with a large enough request body. A remote attacker could
potentially use this flaw to exhaust the pool of available connections and
preventing further, legitimate connections to the Tomcat server to be made.
(CVE-2014-0230)

All users of Red Hat JBoss Web Server 2.1.0 as provided from the Red Hat
Customer Portal are advised to apply this update. The Red Hat JBoss Web
Server process must be restarted for the update to take effect.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files).

4. Bugs fixed (https://bugzilla.redhat.com/):

1191200 - CVE-2014-0230 tomcat: non-persistent DoS attack by feeding data by aborting an upload
1222573 - CVE-2014-7810 Tomcat/JbossWeb: security manager bypass via EL expressions

5. References:

https://access.redhat.com/security/cve/CVE-2014-0230
https://access.redhat.com/security/cve/CVE-2014-7810
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=2.1.0

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFVzLo0XlSAg2UNWIIRAn5EAJ0VDF059K780gyI6N/2jVjcSbclfgCglMLb
yFR0tJnxS1RBQ+xgM8XpQQg=
=Bgvs
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC