Lucene search

K
amazonAmazonALAS-2017-810
HistoryMar 29, 2017 - 4:48 p.m.

Medium: tomcat6

2017-03-2916:48:00
alas.aws.amazon.com
32

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

79.4%

Issue Overview:

It was discovered that the code that parsed the HTTP request line permitted
invalid characters. This could be exploited, in conjunction with a proxy that
also permitted the invalid characters but with a different interpretation, to
inject data into the HTTP response. By manipulating the HTTP response the
attacker could poison a web-cache, perform an XSS attack, or obtain sensitive
information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when
request contains characters that are not permitted by the HTTP specification to
appear not encoded, even though they were previously accepted. The newly
introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow
can be used to configure Tomcat to accept curly braces ({ and }) and the pipe
symbol (|) in not encoded form, as these are often used in URLs without being
properly encoded.

  • A bug was discovered in the error handling of the send file code for the NIO
    HTTP connector. This led to the current Processor object being added to the
    Processor cache multiple times allowing information leakage between requests
    including, and not limited to, session ID and the response body. (CVE-2016-8745)

Affected Packages:

tomcat6

Issue Correction:
Run yum update tomcat6 to update your system.

New Packages:

noarch:  
    tomcat6-webapps-6.0.51-1.10.amzn1.noarch  
    tomcat6-6.0.51-1.10.amzn1.noarch  
    tomcat6-jsp-2.1-api-6.0.51-1.10.amzn1.noarch  
    tomcat6-servlet-2.5-api-6.0.51-1.10.amzn1.noarch  
    tomcat6-lib-6.0.51-1.10.amzn1.noarch  
    tomcat6-el-2.1-api-6.0.51-1.10.amzn1.noarch  
    tomcat6-docs-webapp-6.0.51-1.10.amzn1.noarch  
    tomcat6-admin-webapps-6.0.51-1.10.amzn1.noarch  
    tomcat6-javadoc-6.0.51-1.10.amzn1.noarch  
  
src:  
    tomcat6-6.0.51-1.10.amzn1.src  

Additional References

Red Hat: CVE-2016-6816, CVE-2016-8745

Mitre: CVE-2016-6816, CVE-2016-8745

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

79.4%