SUSE-SU-2015:1565-1: moderate: Security update for tomcat6

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for tomcat6
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:1565-1
Rating:             moderate
References:         #906152 #917127 #926762 #931442 #932698 #934219 
                    
Cross-References:   CVE-2014-0227 CVE-2014-0230 CVE-2014-7810
                   
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4
______________________________________________________________________________

   An update that solves three vulnerabilities and has three
   fixes is now available.

Description:

   This update for Tomcat fixes the following security issues:

   - CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442)
     It was found that the expression language resolver evaluated expressions
     within a privileged code section. A malicious web application could have
     used this flaw to bypass security manager protections.

   - CVE-2014-0227: Limited DoS in chunked transfer encoding input filter.
     (bsc#917127) It was discovered that the ChunkedInputFilter
     implementation did not fail subsequent attempts to read input early
     enough. A remote attacker could have used this flaw to perform a denial
     of service attack, by streaming an unlimited quantity of data, leading
     to consumption of server resources.

   - CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an
     upload It was possible for a remote attacker to trigger a non-persistent
     DoS attack by feeding data by aborting an upload. (bsc#926762)

   Additionally, the following non-security issues have been fixed:

   - Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152)
   - Don't overwrite /var/run/tomcat6.pid when Tomcat is already running.
     (bsc#934219)
   - Miscellaneous fixes and improvements to Tomcat's init script.
     (bsc#932698)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-tomcat6-12092=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11-SP4 (noarch):

      tomcat6-6.0.41-0.47.1
      tomcat6-admin-webapps-6.0.41-0.47.1
      tomcat6-docs-webapp-6.0.41-0.47.1
      tomcat6-javadoc-6.0.41-0.47.1
      tomcat6-jsp-2_1-api-6.0.41-0.47.1
      tomcat6-lib-6.0.41-0.47.1
      tomcat6-servlet-2_5-api-6.0.41-0.47.1
      tomcat6-webapps-6.0.41-0.47.1


References:

   https://www.suse.com/security/cve/CVE-2014-0227.html
   https://www.suse.com/security/cve/CVE-2014-0230.html
   https://www.suse.com/security/cve/CVE-2014-7810.html
   https://bugzilla.suse.com/906152
   https://bugzilla.suse.com/917127
   https://bugzilla.suse.com/926762
   https://bugzilla.suse.com/931442
   https://bugzilla.suse.com/932698
   https://bugzilla.suse.com/934219