[RHSA-2011:0350-01] Important: tomcat5 and tomcat6 security update

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: tomcat5 and tomcat6 security update
Advisory ID:       RHSA-2011:0350-01
Product:           JBoss Enterprise Web Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2011-0350.html
Issue date:        2011-03-10
CVE Names:         CVE-2010-4476 CVE-2011-0534 
=====================================================================

1. Summary:

A patch for JBoss Enterprise Web Server 1.0.1 that fixes two security
issues is now available from the Red Hat Customer Portal.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

A denial of service flaw was found in the way certain strings were
converted to Double objects. A remote attacker could use this flaw to cause
Tomcat 5 or 6 to hang via a specially-crafted HTTP request. (CVE-2010-4476)

A flaw was found in the Tomcat 6 NIO (Non-Blocking I/O) connector. A remote
attacker could use this flaw to cause a denial of service (out-of-memory
condition) via a specially-crafted request containing a large NIO buffer
size request value. (CVE-2011-0534)

All users of JBoss Enterprise Web Server 1.0.1 as provided from the Red Hat
Customer Portal are advised to apply this patch.

3. Solution:

The References section of this erratum contains a patch download link (you
must log in to download the patch). Before applying the patch, backup your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files). After applying the patch, the JBoss
server process must be restarted for the update to take effect.

4. Bugs fixed (http://bugzilla.redhat.com/):

674336 - CVE-2010-4476 JDK Double.parseDouble Denial-Of-Service
675338 - CVE-2011-0534 tomcat: remote DoS via NIO connector

5. References:

https://www.redhat.com/security/data/cve/CVE-2010-4476.html
https://www.redhat.com/security/data/cve/CVE-2011-0534.html
https://access.redhat.com/security/updates/classification/#important
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=1.0.1

6. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFNeXeIXlSAg2UNWIIRApUWAJ9FTdnhK1CwkYVFcnD+vo4epFXaywCfSxwU
Hocwo6gY/eTOoNZESlxf5Ks=
=PtTv
-----END PGP SIGNATURE-----