It was reported that Apache Tomcat was vulnerable to an authentication bypass and information disclosure flaw. Apache Tomcat supports the AJP protocol which is used with reverse proxies to pass requests and associated data about the request from the reverse proxy to Tomcat. The AJP protocol is designed so that when a request includes a request body, an unsolicited AJP message is sent to Tomcat that includes the first part (or possibly all) of the request body. In certain circumstances, Tomcat did not process this message as a request body but as a new request. This permitted an attacker to have full control over the AJP message permitting authentication bypass and information disclosure. This vulnerability only occurs when all of the following are true: * The org.apache.jk.server.JkCoyoteHandler AJP connector is not used * POST requests are accepted * The request body is not processed This flaw will be corrected in Tomcat 5.5.34 (svn r1162960 [1]) and Tomcat 6.0.34 (svn r1162959 [2]). [1] http://svn.apache.org/viewvc?rev=1162960&view=rev [2] http://svn.apache.org/viewvc?rev=1162959&view=rev
Tomcat 5 as shipped with Red Hat Enterprise Linux 5 and tomcat 6 as shipped with Red Hat Enterprise Linux 6 are not affected by this flaw when using the default connector configuration. If tomcat native components (APR) are not present, tomcat 5 and 6 will failover to using the org.apache.jk.server.JkCoyoteHandler (BIO) AJP connector, which is not vulnerable.
There are three different AJP connectors shipped with Red Hat products: org.apache.coyote.ajp.AjpProcessor (Coyote) org.apache.jk.server.JkCoyoteHandler (JK) org.apache.coyote.ajp.AjpAprProcessor (APR) APR is only provided as part of tomcat-native, which is not shipped with Red Hat Enterprise Linux 5 and 6. This flaw affects major Red Hat products as follows: Tomcat 5 (RHEL 5): Coyote not available, JK not affected. Product not affected. Tomcat 5 (EWS 1): Coyote not available, JK not affected, APR affected. Product affected. Customers only affected if using tomcat-native. Tomcat 6 (RHEL 6): Coyote affected. JK not affected. Product affected. Customers only affected if using Coyote, which is not the default and needs to be manually configured. Tomcat 6 (EWS 1): Coyote affected, JK not affected, APR affected. Product affected. JBoss Web: All products using JBoss Web are not affected. A patch made back in 2008 mitigated this vulnerability. Patch documented here: https://issues.jboss.org/browse/JBWEB-117 Commit diff here: http://source.jboss.org/changelog/JBossWeb/?cs=770
Next on the list.
Created tomcat6 tracking bugs for this issue Affects: fedora-all [bug 738502]
Created tomcat5 tracking bugs for this issue Affects: fedora-all [bug 738501]
Updated mitigation options for Tomcat-5 from upstream: ====================================================== Mitigation options: 1) Upgrade to Tomcat 5.5.34. 2) Apply the appropriate patch. 3) Configure both Tomcat and the reverse proxy to use a shared secret. (It is "request.secret" attribute in AJP <Connector>, "worker.workername.secret" directive for mod_jk. The mod_proxy_ajp module currently does not support shared secrets). 4) Use the org.apache.jk.server.JkCoyoteHandler (BIO) AJP connector implementation. (It is automatically selected if you do not have Tomcat-Native library installed. It can be also selected explicitly: <Connector protocol="org.apache.jk.server.JkCoyoteHandler">). Relevant patch mentioned in point 2): http://svn.apache.org/viewvc?view=rev&rev=1162960 Updated mitigation options for Tomcat-6 from upstream: ====================================================== Mitigation options: 1) Upgrade to Tomcat 6.0.34. 2) Apply the appropriate patch. 3) Configure both Tomcat and the reverse proxy to use a shared secret. (It is "request.secret" attribute in AJP <Connector>, "worker.workername.secret" directive for mod_jk. The mod_proxy_ajp module currently does not support shared secrets). 4) Use the org.apache.jk.server.JkCoyoteHandler (BIO) AJP connector implementation. (It is automatically selected if you do not have Tomcat-Native library installed. It can be also selected explicitly: <Connector protocol="org.apache.jk.server.JkCoyoteHandler">). Relevant patch mentioned in point 2): http://svn.apache.org/viewvc?view=rev&rev=1162959
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:1780 https://rhn.redhat.com/errata/RHSA-2011-1780.html
Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?
(In reply to comment #23) > Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)? An erratum for EWS 1.0.2 is in progress. It is currently awaiting QE.
This issue has been addressed in following products: JBEWS 1.0 for RHEL 5 JBEWS 1.0 for RHEL 6 Via RHSA-2012:0680 https://rhn.redhat.com/errata/RHSA-2012-0680.html
This issue has been addressed in following products: JBEWS 1.0 Via RHSA-2012:0679 https://rhn.redhat.com/errata/RHSA-2012-0679.html
This issue has been addressed in following products: JBEWS 1.0 Via RHSA-2012:0681 https://rhn.redhat.com/errata/RHSA-2012-0681.html
This issue has been addressed in following products: JBEWS 1.0 for RHEL 5 JBEWS 1.0 for RHEL 6 Via RHSA-2012:0682 https://rhn.redhat.com/errata/RHSA-2012-0682.html