(Red Hat Issues Fix for JBoss) Apache Tomcat Request Processing Lets Remote Users Deny Service
SecurityTracker Alert ID: 1033293|
SecurityTracker URL: http://securitytracker.com/id/1033293
(Links to External Site)
Date: Aug 14 2015
Denial of service via network|
Fix Available: Yes Vendor Confirmed: Yes |
A vulnerability was reported in Apache Tomcat. A remote user can cause denial of service conditions on the target system. JBoss is affected.|
A remote user can send a specially crafted request to temporarily consume excessive CPU resources on the target system.
AntBean@secdig from the Baidu Security Team reported this vulnerability.
A remote user can consume excessive memory on the target system.|
Red Hat has issued a fix for JBoss.|
The Red Hat advisories are available at:
Vendor URL: rhn.redhat.com/errata/RHSA-2015-1621.html (Links to External Site)
|Underlying OS: Linux (Red Hat Enterprise)|
|Underlying OS Comments: 5, 6, 7|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Subject: [RHSA-2015:1621-01] Moderate: Red Hat JBoss Web Server 2.1.0 tomcat security update|
-----BEGIN PGP SIGNED MESSAGE-----
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Web Server 2.1.0 tomcat security update
Advisory ID: RHSA-2015:1621-01
Product: Red Hat JBoss Web Server
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1621.html
Issue date: 2015-08-13
CVE Names: CVE-2014-0230 CVE-2014-7810
An update for the Apache Tomcat 6 and Apache Tomcat 7 component for Red Hat
JBoss Web Server 2.1.0 that fixes two security issues is now available from
the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
It was found that the expression language resolver evaluated expressions
within a privileged code section. A malicious web application could use
this flaw to bypass security manager protections. (CVE-2014-7810)
It was found that Tomcat would keep connections open after processing
requests with a large enough request body. A remote attacker could
potentially use this flaw to exhaust the pool of available connections and
preventing further, legitimate connections to the Tomcat server to be made.
All users of Red Hat JBoss Web Server 2.1.0 as provided from the Red Hat
Customer Portal are advised to apply this update. The Red Hat JBoss Web
Server process must be restarted for the update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files).
4. Bugs fixed (https://bugzilla.redhat.com/):
1191200 - CVE-2014-0230 tomcat: non-persistent DoS attack by feeding data by aborting an upload
1222573 - CVE-2014-7810 Tomcat/JbossWeb: security manager bypass via EL expressions
The Red Hat security contact is <firstname.lastname@example.org>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-----END PGP SIGNATURE-----
RHSA-announce mailing list