Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony, IBM Spectrum Symphony (CVE-2017-15698, CVE-2017-15706, CVE-2018-1323, CVE-2018-1305, CVE-2018-1304)

Summary

This interim fix provides instructions on upgrading Apache Tomcat from v5.5.36 to v7.0.88 in IBM Platform Symphony 6.1.1 and from v6.0.43 to v8.5.31 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address a security vulnerability in Tomcat (CVE-2017-15698, CVE-2017-15706, CVE-2018-1323, CVE-2018-1305, CVE-2018-1304).

Vulnerability Details

CVE-ID: CVE-2017-15698
Description: Apache Tomcat Native Connector could allow a remote attacker to bypass security restrictions, caused by the improper handling of fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. The parsing error resulted in the OCSP check being omitted and made it possible for client certificates that should have been rejected to be accepted.
CVSS Base Score: 5.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/138491&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVE-ID: CVE-2017-15706
Description: Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the CGI Servlet to identify which script to execute. The error resulted in the failure of some scripts to execute as expected and other scripts may have been executed unexpectedly.
CVSS Base Score: 5.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/138486&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVE-ID: CVE-2018-1323
Description: Apache Tomcat JK ISAPI Connector could allow a remote attacker to obtain sensitive information, caused by the improper handling of HTTP request paths in jk_isapi_plugin.c. An attacker could exploit this vulnerability using the reverse proxy to expose application resources.
CVSS Base Score: 7.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/140213&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVE-ID: CVE-2018-1305
Description: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security constraints that are defined by annotations of Servlets in certain cases. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources.
CVSS Base Score: 7.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/139475&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVE-ID: CVE-2018-1304
Description: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security constraint definitions that contain a URL pattern of “” (the empty string) that exactly maps to the context root. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources.
CVSS Base Score: 7.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/139476&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Platform Symphony 6.1.1 and IBM Spectrum Symphony 7.1 Fix Pack 1

Remediation/Fixes

Applicability
Operating systems: Linux2.6-glibc2.3-x86_64
Cluster type: Single grid cluster
Package Download location

• Download these interim fixes from IBM Fix Central:
  sym6.1.1_lnx26-lib23-x64_build490873.tar.gz:
  http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/Platform+Symphony&release=All&platform=All&function=fixId&fixids=sym-6.1.1-build490873&includeSupersedes=0
  sym7.1_lnx26-lib23-x64_build491553.tar.gz:
  http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/Other+software/Platform+Symphony&release=All&platform=All&function=fixId&fixids=sym-7.1-build491553&includeSupersedes=0
• Download Tomcat 7.0.88 (apache-tomcat-7.0.88.tar.gz) from the following location: <http://archive.apache.org/dist/tomcat/tomcat-7/v7.0.88/bin/&gt;
• Download Tomcat 8.5.31 (apache-tomcat-8.5.31.tar.gz) from the following location: http://archive.apache.org/dist/tomcat/tomcat-8/v8.5.31/bin/
  For Platform Symphony 6.1.1 Installation Optional prerequisite
  For a Platform Symphony 6.1.1 cluster, you can optionally take advantage of a security service pack. To apply this interim fix along with the security service pack:
  1. Install the service pack (sym-6.1.1-spk-Security-build227853).
  2. Apply this interim fix to your cluster (sym6.1.1_lnx26-lib23-x64_build490873.tar.gz).
  If you do not want to apply the 6.1.1 security service pack, proceed to directly apply this interim fix to your cluster.
  Before installation
  1. Log on to the master host as the cluster administrator** and stop the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service stop WEBGUI
  2. Log on to each management host in the cluster and back up the following files for recovery purposes:
  $EGO_TOP/gui/1.2.8/tomcat/
  $EGO_CONFDIR/…/…/gui/conf/catalina.policy
  $EGO_CONFDIR/…/…/gui/conf/catalina.properties
  $EGO_CONFDIR/…/…/gui/conf/server.xml
  $EGO_TOP/gui/ego/1.2.8/platform/WEB-INF/web.xml
  $EGO_TOP/gui/is/6.1.1/isgui/WEB-INF/web.xml
  $EGO_TOP/gui/perf/1.2.8/perfgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/6.1.1/symgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/6.1.1/soamgui/WEB-INF/web.xml
  Installation
  1. On each management host, copy the apache-tomcat-7.0.88.tar.gz package to a temporary folder and decompress the file:
  > cp apache-tomcat-7.0.88.tar.gz /tmp
  > tar zxvf apache-tomcat-7.0.88.tar.gz
  > rm -rf apache-tomcat-7.0.88/conf/
  > rm -rf apache-tomcat-7.0.88/work/
  > rm -rf apache-tomcat-7.0.88/logs/
  2. Copy the Tomcat folder:
  > rm -rf $EGO_TOP/gui/1.2.8/tomcat
  > cp -rf apache-tomcat-7.0.88 $EGO_TOP/gui/1.2.8/tomcat
  3. Copy the sym6.1.1_lnx26-lib23-x64_build490873.tar.gz package and decompress it:
  > tar zxfo sym6.1.1_lnx26-lib23-x64_build490873.tar.gz -C $EGO_TOP
  a. If you ran the “egoconfig mghost shared_dir” command during installation to set up a shared location for configuration files, ensure that the configuration file is changed in the shared directory:
  > cp $EGO_TOP/gui/conf/catalina.policy $EGO_CONFDIR/…/…/gui/conf/catalina.policy
  > cp $EGO_TOP/gui/conf/catalina.properties $EGO_CONFDIR/…/…/gui/conf/catalina.properties
  > cp $EGO_TOP/gui/conf/server.xml $EGO_CONFDIR/…/…/gui/conf/server.xml
  b. If you modified the server.xml configuration file for details such as the GUI service port, manually redo those changes:
  $EGO_CONFDIR/…/…/gui/conf/server.xml
  4. Edit the web.xml files to add the following configuration:
  a. Edit each of the following files:
  $EGO_TOP/gui/ego/1.2.8/platform/WEB-INF/web.xml
  $EGO_TOP/gui/is/6.1.1/isgui/WEB-INF/web.xml
  $EGO_TOP/gui/perf/1.2.8/perfgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/6.1.1/symgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/6.1.1/soamgui/WEB-INF/web.xml
  b. Find the “<servlet-name>dwr-invoker</servlet-name>” line in the “</servlet>” section and add the following configuration:
  <init-param>
  <param-name>crossDomainSessionSecurity</param-name>
  <param-value>false</param-value>
  </init-param>
  For example:
  <servlet>
  <servlet-name>dwr-invoker</servlet-name>
  <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
  <init-param>
  <param-name>debug</param-name>
  <param-value>true</param-value>
  </init-param>
  _ _ <init-param>
  <param-name>crossDomainSessionSecurity</param-name>
  <param-value>false</param-value>
  </init-param> **
  </servlet>
  After installation
  1. On each management host, delete all subdirectories and files in the following directory:
  > rm -rf $EGO_TOP/gui/work/*
  2. On all client hosts, open your web browser and clear the browser cache.
  3. Start the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service start WEBGUI
  4. In the $EGO_TOP/gui/logs/catalina.out file, check whether the GUI version indicates version 7.0.88:
  INFO: Server version: Apache Tomcat/7.0.88
  Uninstallation (if required)
  Follow the instructions in this section to uninstall this update in your cluster, if required.
  1. Log on to the master host as the cluster administrator** and stop the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service stop WEBGUI
  2. On each management host, restore the backup files:
  a. Remove the Tomcat folder, which was introduced by this interim fix:
  > rm -rf $EGO_TOP/gui/1.2.8/tomcat
  b. Restore the following folders and files from your backup:
  $EGO_TOP/gui/1.2.8/tomcat/
  $EGO_CONFDIR/…/…/gui/conf/catalina.policy
  $EGO_CONFDIR/…/…/gui/conf/catalina.properties
  $EGO_CONFDIR/…/…/gui/conf/server.xml
  $EGO_TOP/gui/ego/1.2.8/platform/WEB-INF/web.xml
  $EGO_TOP/gui/is/6.1.1/isgui/WEB-INF/web.xml
  $EGO_TOP/gui/perf/1.2.8/perfgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/6.1.1/symgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/6.1.1/soamgui/WEB-INF/web.xml
  3. Delete all subdirectories and files in the following directory:
  > rm -rf $EGO_TOP/gui/work/
  4. On all client hosts, open your web browser and clear the browser cache.
  5. Start the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service start WEBGUI
  For Platform Symphony 7.1 Fix Pack 1 Installation Before installation
  1. Log on to the master host as the cluster administrator* and stop the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service stop WEBGUI
  2. Log on to each management host in the cluster and back up the following files for recovery purposes:
  $EGO_TOP/gui/3.1/tomcat/
  $EGO_CONFDIR/…/…/gui/conf/catalina.policy
  $EGO_CONFDIR/…/…/gui/conf/catalina.properties
  $EGO_CONFDIR/…/…/gui/conf/server.xml
  $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
  $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
  $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
  Installation
  1. Copy the apache-tomcat-8.5.31.tar.gz package to a temporary folder and decompress the file:
  > cp apache-tomcat-8.5.31.tar.gz /tmp
  > tar zxvf apache-tomcat-8.5.31.tar.gz
  > rm -rf apache-tomcat-8.5.31/conf/
  > rm -rf apache-tomcat-8.5.31/work/
  > rm -rf apache-tomcat-8.5.31/logs/
  2. Copy the Tomcat folder:
  > rm -rf $EGO_TOP/gui/3.1/tomcat
  > cp -rf apache-tomcat-8.5.31 $EGO_TOP/gui/3.1/tomcat
  3. Copy the sym7.1_lnx26-lib23-x64_build491553.tar.gz package and decompress it:
  > tar zxfo sym7.1_lnx26-lib23-x64_build491553.tar.gz -C $EGO_TOP
  a. If you ran the “egoconfig mghost shared_dir” command during installation to set up a shared location for configuration files, ensure that the configuration file is changed in the shared directory:
  > cp $EGO_TOP/gui/conf/catalina.policy $EGO_CONFDIR/…/…/gui/conf/catalina.policy
  > cp $EGO_TOP/gui/conf/catalina.properties $EGO_CONFDIR/…/…/gui/conf/catalina.properties
  > cp $EGO_TOP/gui/conf/server.xml $EGO_CONFDIR/…/…/gui/conf/server.xml
  b. If you modified the server.xml configuration file for details such as the GUI service port, manually redo those changes:
  $EGO_CONFDIR/…/…/gui/conf/server.xml
  4. Edit the web.xml files to add the following configuration:
  a. Edit each of the following files:
  $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
  $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
  $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
  b. Find the “<servlet-name>dwr-invoker</servlet-name>” line in the “</servlet>” section and add the following configuration:
  <init-param>
  <param-name>crossDomainSessionSecurity</param-name>
  <param-value>false</param-value>
  </init-param>
  For example:
  <servlet>
  <servlet-name>dwr-invoker</servlet-name>
  <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
  <init-param>
  <param-name>debug</param-name>
  <param-value>true</param-value>
  </init-param>
  _ _ <init-param>
  <param-name>crossDomainSessionSecurity</param-name>
  <param-value>false</param-value>
  </init-param> **
  </servlet>
  After installation
  1. On each management host, delete all subdirectories and files in the following directory:
  > rm -rf $EGO_TOP/gui/work/*
  2. On all client hosts, open your web browser and clear the browser cache.
  3. Start the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service start WEBGUI
  4. In the $EGO_TOP/gui/logs/catalina.out file, check whether the GUI version indicates version 8.5.31:
  INFO: Server version: Apache Tomcat/8.5.31
  Uninstallation (if required)
  Follow the instructions in this section to uninstall this update in your cluster, if required.
  1. Log on to the master host as the cluster administrator** *and stop the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service stop WEBGUI
  2. On each management host, restore the backup files:
  a. Remove the Tomcat folder, which was introduced by this interim fix:
  > rm -rf $EGO_TOP/gui/3.1/tomcat
  b. Restore the following folders and files from your backup:
  $EGO_TOP/gui/3.1/tomcat
  $EGO_CONFDIR/…/…/gui/conf/catalina.policy
  $EGO_CONFDIR/…/…/gui/conf/catalina.properties
  $EGO_CONFDIR/…/…/gui/conf/server.xml
  $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
  $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
  $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
  $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
  3. Delete all subdirectories and files in the following directory:
  > rm -rf $EGO_TOP/gui/work/
  4. On all client hosts, open your web browser and clear the browser cache.
  5. Start the WEBGUI service:
  > source $EGO_TOP/cshrc.platform
  > egosh service start WEBGUI

Workarounds and Mitigations

None