Lucene search

K
amazonAmazonALAS-2017-810
HistoryMar 29, 2017 - 4:48 p.m.

Medium: tomcat6

2017-03-2916:48:00
alas.aws.amazon.com
24

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.9%

Issue Overview:

It was discovered that the code that parsed the HTTP request line permitted
invalid characters. This could be exploited, in conjunction with a proxy that
also permitted the invalid characters but with a different interpretation, to
inject data into the HTTP response. By manipulating the HTTP response the
attacker could poison a web-cache, perform an XSS attack, or obtain sensitive
information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when
request contains characters that are not permitted by the HTTP specification to
appear not encoded, even though they were previously accepted. The newly
introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow
can be used to configure Tomcat to accept curly braces ({ and }) and the pipe
symbol (|) in not encoded form, as these are often used in URLs without being
properly encoded.

  • A bug was discovered in the error handling of the send file code for the NIO
    HTTP connector. This led to the current Processor object being added to the
    Processor cache multiple times allowing information leakage between requests
    including, and not limited to, session ID and the response body. (CVE-2016-8745)

Affected Packages:

tomcat6

Issue Correction:
Run yum update tomcat6 to update your system.

New Packages:

noarch:  
    tomcat6-webapps-6.0.51-1.10.amzn1.noarch  
    tomcat6-6.0.51-1.10.amzn1.noarch  
    tomcat6-jsp-2.1-api-6.0.51-1.10.amzn1.noarch  
    tomcat6-servlet-2.5-api-6.0.51-1.10.amzn1.noarch  
    tomcat6-lib-6.0.51-1.10.amzn1.noarch  
    tomcat6-el-2.1-api-6.0.51-1.10.amzn1.noarch  
    tomcat6-docs-webapp-6.0.51-1.10.amzn1.noarch  
    tomcat6-admin-webapps-6.0.51-1.10.amzn1.noarch  
    tomcat6-javadoc-6.0.51-1.10.amzn1.noarch  
  
src:  
    tomcat6-6.0.51-1.10.amzn1.src  

Additional References

Red Hat: CVE-2016-6816, CVE-2016-8745

Mitre: CVE-2016-6816, CVE-2016-8745

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.9%