Summary
Two security issues have been found in the Tomcat servlet and JSP engine:
CVE-2012-3544
The input filter for chunked transfer encodings could trigger high resource consumption through malformed CRLF sequences, resulting in denial of service.
CVE-2013-2067
The FormAuthenticator module was vulnerable to session fixation.
Solution
For the oldstable distribution (squeeze), these problems have been fixed in version 6.0.35-1+squeeze3. This update also provides fixes for CVE-2012-2733,
CVE-2012-3546,
CVE-2012-4431,
CVE-2012-4534,
CVE-2012-5885,
CVE-2012-5886 and
CVE-2012-5887
,
which were all fixed for stable already.
For the stable distribution (wheezy), these problems have been fixed in version 6.0.35-6+deb7u1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your tomcat6 packages.
Insight
Apache Tomcat implements the Java Servlet and the JavaServer Pages (JSP) specifications from Sun Microsystems, and provides a 'pure Java' HTTP web server environment for Java code to run.
Affected
tomcat6 on Debian Linux
Detection
This check tests the installed software version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2012-2733, CVE-2012-3544, CVE-2012-3546, CVE-2012-4431, CVE-2012-4534, CVE-2012-5885, CVE-2012-5886, CVE-2012-5887, CVE-2013-2067 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities