CVE-2014-7810

  This update fixes the following security issue:
  - CVE-2014-7810: Security manager bypass via EL expression (bnc#931442)

This update of tomcat6 fixes:

* apache-tomcat-CVE-2012-3544.patch (bnc#831119)
* use chown --no-dereference to prevent symlink attacks on log
  (bnc#822177#c7/prevents CVE-2013-1976)
* Fix tomcat init scripts generating malformed classpath (
  http://youtrack.jetbrains.com/issue/JT-18545
  <http://youtrack.jetbrains.com/issue/JT-18545> ) bnc#804992 (patch
  from m407)
* fix a typo in initscript (bnc#768772 )
* copy all shell scripts (bnc#818948)

Security Issue references:

* CVE-2012-3544
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3544>
* CVE-2013-1976
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1976>
* CVE-2012-0022
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0022>

This update for Tomcat fixes the following security issues:

• CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442) It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could have used this flaw to bypass security manager protections.

• CVE-2014-0227: Limited DoS in chunked transfer encoding input filter. (bsc#917127) It was discovered that the ChunkedInputFilter implementation did not fail subsequent attempts to read input early enough. A remote attacker could have used this flaw to perform a denial of service attack, by streaming an unlimited quantity of data, leading to consumption of server resources.

• CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an upload It was possible for a remote attacker to trigger a non-persistent DoS attack by feeding data by aborting an upload. (bsc#926762)

Additionally, the following non-security issues have been fixed:

• Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152)
• Don't overwrite /var/run/tomcat6.pid when Tomcat is already running. (bsc#934219)
• Miscellaneous fixes and improvements to Tomcat's init script. (bsc#932698)

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

It was discovered that the Tomcat XML parser incorrectly handled XML External Entities (XXE). A remote attacker could possibly use this issue to read arbitrary files. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0119)

It was discovered that Tomcat incorrectly handled data with malformed chunked transfer coding. A remote attacker could possibly use this issue to conduct HTTP request smuggling attacks, or cause Tomcat to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0227)

It was discovered that Tomcat incorrectly handled HTTP responses occurring before the entire request body was finished being read. A remote attacker could possibly use this issue to cause a limited denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0230)

It was discovered that the Tomcat Expression Language (EL) implementation incorrectly handled accessible interfaces implemented by inaccessible classes. An attacker could possibly use this issue to bypass a SecurityManager protection mechanism. (CVE-2014-7810)