Bug 19672

Fixed! updating to 7.0.72

Thanks David!

Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=8307#c17

Advisory:
========================

Updated tomcat packages fix security vulnerability:

The Realm implementations did not process the supplied password if the
supplied user name did not exist. This made a timing attack possible to
determine valid user names. Note that the default configuration includes
the LockOutRealm which makes exploitation of this vulnerability harder
(CVE-2016-0762).

A malicious web application was able to bypass a configured SecurityManager
via a Tomcat utility method that was accessible to web applications
(CVE-2016-5018).

It was discovered that the Tomcat packages installed configuration file
/usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the
group or a malicious web application deployed on Tomcat could use this flaw to
escalate their privileges (CVE-2016-5425).

It was discovered that the Tomcat packages installed certain configuration
files read by the Tomcat initialization script as writeable to the tomcat
group. A member of the group or a malicious web application deployed on Tomcat
could use this flaw to escalate their privileges (CVE-2016-6325).

When a SecurityManager is configured, a web application's ability to read
system properties should be controlled by the SecurityManager. Tomcat's system
property replacement feature for configuration files could be used by a
malicious web application to bypass the SecurityManager and read system
properties that should not be visible (CVE-2016-6794).

A malicious web application was able to bypass a configured SecurityManager
via manipulation of the configuration parameters for the JSP Servlet
(CVE-2016-6796).

The ResourceLinkFactory did not limit web application access to global JNDI
resources to those resources explicitly linked to the web application.
Therefore, it was possible for a web application to access any global JNDI
resource whether an explicit ResourceLink had been configured or not
(CVE-2016-6797).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5018
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5425
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6325
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6794
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797
http://openwall.com/lists/oss-security/2016/10/27/7
http://openwall.com/lists/oss-security/2016/10/27/8
http://openwall.com/lists/oss-security/2016/10/27/9
http://openwall.com/lists/oss-security/2016/10/27/10
http://openwall.com/lists/oss-security/2016/10/27/11
https://rhn.redhat.com/errata/RHSA-2016-2046.html
========================

Updated packages in core/updates_testing:
========================
tomcat-7.0.72-1.mga5
tomcat-admin-webapps-7.0.72-1.mga5
tomcat-docs-webapp-7.0.72-1.mga5
tomcat-javadoc-7.0.72-1.mga5
tomcat-jsvc-7.0.72-1.mga5
tomcat-jsp-2.2-api-7.0.72-1.mga5
tomcat-lib-7.0.72-1.mga5
tomcat-servlet-3.0-api-7.0.72-1.mga5
tomcat-el-2.2-api-7.0.72-1.mga5
tomcat-webapps-7.0.72-1.mga5

from tomcat-7.0.72-1.mga5.src.rpm

Assignee: geiger.david68210 => qa-bugs
Severity: normal => critical

*** Bug 19560 has been marked as a duplicate of this bug. ***

Tested Mageia 5 x64, all data from the duplicate bug:
 https://bugs.mageia.org/show_bug.cgi?id=19560
and particularly Comment 9 Comment 10 Comment 13 where Len found a PoC and demonstrated that the update fixes that problem. Many thanks for that.

That other bug shows that the web interface
 http://localhost:8080/
samples
 http://localhost:8080/sample
& tests
 http://localhost:8080/examples
work (mostly) after suitable adaptation of the config file
 /etc/tomcat/tomcat-users.xml
as per the test link given: "uncomment the users, adding manager-gui role to one of them". I added:
 <role rolename="manager-gui"/>
 <user username="[...]" password="[...]" roles="manager-gui"/>

The only doubt was the lack of 'logout' from the manage page. Returning to the "Manager App" button on the main entry page, which on first usage asks for user & password login, subsequently often goes straight to the manage page *without* the login. However, re-trying this after a re-boot, it did not happen. Nor with Firefox now after simply re-starting the browser.
So I count this a red herring, and OK this for 64-bit.

@Len : were any of your tests on 32-bit? If so, please OK that.

CC: (none) => lewyssmith
Whiteboard: (none) => MGA5-64-OK

@lewis : no, I gave up on it when I could no longer switch roles.

CC: (none) => tarazed25

Advisory uploaded.

Whiteboard: MGA5-64-OK => MGA5-64-OK advisory

MGA5-32 on Acer D620 Xfce
No installation issues
Completed tests as indicated in Comment 4, no remarks to be added.

CC: (none) => herman.viaene
Whiteboard: MGA5-64-OK advisory => MGA5-64-OK MGA-5-32-OK advisory

Validating. Advisory already in place.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0367.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED