drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Apache Tomcat
Name: |
Mehrere Probleme in Apache Tomcat |
|
ID: |
201705-09 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Do, 18. Mai 2017, 06:36 |
|
Referenzen: |
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5346
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0706
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3092
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5647
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5651
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0763
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5174
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8745
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0714
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5345
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5648
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1240
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5351
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5650 |
|
Applikationen: |
Apache Tomcat |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Uj0KR4eDT9mdJTLk2MCe3MOOCRRMN2mXJ Content-Type: multipart/mixed; boundary="SKKBd9VlC8wusCVbXKC9aaUtloHAjIa1g"; protected-headers="v1" From: Yury German <blueknight@gentoo.org> To: gentoo-announce@lists.gentoo.org Message-ID: <003eed54-1d18-53bf-3623-18d427c3b24d@gentoo.org> Subject: [ GLSA 201705-09 ] Apache Tomcat: Multiple vulnerabilities
--SKKBd9VlC8wusCVbXKC9aaUtloHAjIa1g Content-Type: text/plain; charset=utf-8 Content-Language: en-U Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201705-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High Title: Apache Tomcat: Multiple vulnerabilities Date: May 18, 2017 Bugs: #575796, #586966, #595978, #615868 ID: 201705-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
Multiple vulnerabilities have been found in Apache Tomcat, the worst of which could lead to privilege escalation.
Background ==========
Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/tomcat < 8.0.36 >= 7.0.70 >= 8.0.36
Description ===========
Multiple vulnerabilities have been discovered in Tomcat. Please review the CVE identifiers referenced below for details.
Impact ======
A remote attacker may be able to cause a Denial of Service condition, obtain sensitive information, bypass protection mechanisms and authentication restrictions.
A local attacker, who is a tomcat's system user or belongs to tomcatâs group, could potentially escalate privileges.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
All Apache Tomcat users have to manually check their Tomcat runscripts to make sure that they don't use an old, vulnerable runscript. In addition:
All Apache Tomcat 7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-7.0.70:7"
All Apache Tomcat 8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.0.36:8"
References ==========
[ 1 ] CVE-2015-5174 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5174 [ 2 ] CVE-2015-5345 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5345 [ 3 ] CVE-2015-5346 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5346 [ 4 ] CVE-2015-5351 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5351 [ 5 ] CVE-2016-0706 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0706 [ 6 ] CVE-2016-0714 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0714 [ 7 ] CVE-2016-0763 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0763 [ 8 ] CVE-2016-1240 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1240 [ 9 ] CVE-2016-3092 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3092 [ 10 ] CVE-2016-8745 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8745 [ 11 ] CVE-2017-5647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5647 [ 12 ] CVE-2017-5648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5648 [ 13 ] CVE-2017-5650 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5650 [ 14 ] CVE-2017-5651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5651
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201705-09
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--SKKBd9VlC8wusCVbXKC9aaUtloHAjIa1g--
--Uj0KR4eDT9mdJTLk2MCe3MOOCRRMN2mXJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQEcBAEBCAAGBQJZHP9cAAoJEB9lYVdQaQ1Q6BYIAIJpK7KImff8JSHbUKlvQhCP PKl2H/McnlV4gPj7UvZmX3p0FfG7Kb8A2LJvfGcPi8G4VDLpHKsVz60mY7orWpV9 YqCDBj0q792t+1jL3zq1aQYBVDDyrR9Tobw5TlOZSvAFk3uEbuH4g6XHaycOPOA1 s1VWTgnbnYxGItTNoKAMF6//IrjO0t1X04HeLkGvS3EjCpKQ1PGUxey6oEEcftm5 d/2iEdrHTarWXR1MnF2pnwEAqhbQt4ACv6ZAUnF2WJC/HU4+p9Y0gknKqrOieyKz qCC6RplPifc7VVcmSZYRKFsd4dxba9aqQBCso5QnUK+iOPoO+mvAwGh8Dw/JaEk= =dJjc -----END PGP SIGNATURE-----
--Uj0KR4eDT9mdJTLk2MCe3MOOCRRMN2mXJ--
|
|
|
|