| Descripción: | Summary:
The remote host is missing an update for the 'tomcat6' package(s) announced via the MGASA-2014-0082 advisory.
Vulnerability Insight:
Updated tomcat6 packages fix security vulnerabilities:
It was discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could use this
flaw to cause the Tomcat server to stop responding, resulting in a denial
of service (CVE-2012-3544).
A frame injection in the Javadoc component in Oracle Java SE 7 Update 21
and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier,
JavaFX 2.2.21 and earlier, and OpenJDK 7 allows remote attackers to affect
integrity via unknown vectors related to Javadoc (CVE-2013-1571)
A flaw was found in the way the tomcat6 init script handled the
tomcat6-initd.log log file. A malicious web application deployed on Tomcat
could use this flaw to perform a symbolic link attack to change the
ownership of an arbitrary system file to that of the tomcat user, allowing
them to escalate their privileges to root (CVE-2013-1976).
It was discovered that Tomcat incorrectly handled certain authentication
requests. A remote attacker could possibly use this flaw to inject a
request that would get executed with a victim's credentials (CVE-2013-2067).
Note: With this update, tomcat6-initd.log has been moved from
/var/log/tomcat6/ to the /var/log/ directory.
Affected Software/OS:
'tomcat6' package(s) on Mageia 3.
Solution:
Please install the updated package(s).
CVSS Score:
6.9
CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
|
