CVE-2010-2086

JBoss Enterprise Web Server 1.0.0 ships with Apache MyFaces 1.1.0. Apache MyFaces 1.1.0 does not support encrypted view state. When the application's view state is not encrypted, it is possible for an attacker to supply a new or modified view object as part of a request. This allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

This issue is resolved in JBoss Enterprise Web Server 1.0.1 because it does not include Apache MyFaces.

CVE-2009-3555

A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation on Red Hat Enterprise Linux 4 and 5. A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials.

Refer to the following Knowledgebase article for more information about how this issue affects JBoss Enterprise Web Server: http://kbase.redhat.com/faq/docs/DOC-20491

CVE-2009-3095

A flaw was found in the Apache mod_proxy_ftp module on Red Hat Enterprise Linux 4 and 5 such that, in a reverse proxy configuration, a remote attacker could bypass intended access restrictions by creating a HTTP Authorization header and send arbitrary commands to the FTP server. (RHSA-2010:0011)

CVE-2009-3094

A NULL pointer dereference flaw was found in the Apache mod_proxy_ftp module on Red Hat Enterprise Linux 4 and 5. A malicious FTP server to which requests were proxied could use this flaw to crash an httpd child process through a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service. (RHSA-2010:0011)

CVE-2009-2902

A directory traversal flaw was found in the Tomcat deployment process. WAR file names were not being sanitized during Tomcat deployment in Red Hat Enterprise Linux 4 and 5. This could allow attackers to create a specially-crafted WAR file that could delete files in the Tomcat host's work directory. (RHSA-2010:0119)

CVE-2009-2699

A flaw was found in the way errors were handled in the Event Port back end in the Apache Portable Runtime (APR) library, used by the Apache HTTP Server. If an error was incorrectly handled while processing HTTP requests, httpd could hang. Note: This flaw only affected users running JBoss Enterprise Web Server on the Solaris operating system.

CVE-2009-2693

A directory traversal flaw was found in the Tomcat deployment process. An attacker could create a specially-crafted WAR file which, once deployed by an unsuspecting local user, would lead to attacker-controlled content being deployed outside the web root, into directories accessible to the Tomcat process. (RHSA-2010:0119)

CVE-2009-2412

Multiple integer overflow flaws that led to heap-based buffer overflows were found in the way the Apache Portable Runtime (APR) included in httpd22 manages memory pool and relocatable memory allocations on Red Hat Enterprise Linux 4. An attacker could use these flaws to issue a specially-crafted request for memory allocation, which would lead to a denial of service (application crash) or, potentially, execute arbitrary code with the privileges of an application using the APR libraries. (RHSA-2009:1462)

CVE-2009-1955

A denial of service flaw was found in the Apache HTTP Server apr-util Extensible Markup Language (XML) parser for Red Hat Enterprise Linux 4. A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine. (RHSA-2009:1160)

CVE-2009-1891

A denial of service flaw was found in the Apache HTTP Server mod_deflate module for Red Hat Enterprise Linux 4 and 5. This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This caused mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file. (RHSA-2009:1155, RHSA-2009:1160)

CVE-2009-1890

A denial of service flaw was found in the Apache HTTP Server mod_proxy module when it was used as a reverse proxy on Red Hat Enterprise Linux 4 and 5. A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time. (RHSA-2009:1155, RHSA-2009:1160)

CVE-2009-1195

In Apache HTTP Server on Red Hat Enterprise Linux 4 and 5, in configurations using the AllowOverride directive with certain Options= arguments, local users were not restricted from executing commands from a Server-Side-Include script as intended. (RHSA-2009:1155, RHSA-2009:1160)

CVE-2009-0783

In Tomcat 5 and 6 on Red Hat Enterprise Linux 4 and 5, web applications containing their own XML parsers could replace the XML parser that Tomcat uses to parse configuration files. A malicious web application running on a Tomcat instance could read or, potentially, modify the configuration and XML-based data of other web applications deployed on the same Tomcat instance. (RHSA-2009:1506, RHSA-2009:1454)

CVE-2009-0580

In Tomcat 5 and 6 on Red Hat Enterprise Linux 4 and 5, the error checking methods of certain authentication classes did not have sufficient error checking, allowing remote attackers to ennumerate (via brute force methods) usernames registered with applications running on Tomcat when FORM-based authentication was used. (RHSA-2009:1506, RHSA-2009:1454)

CVE-2009-0033

A flaw was found in the way that the Tomcat 5 and 6 AJP (Apache JServ Protocol) connector processed AJP connections on Red Hat Enterprise Linux 4 and 5. An attacker could use this flaw to send specially-crafted requests that would cause a temporary denial of service. (RHSA-2009:1506, RHSA-2009:1454)

CVE-2009-0023

A heap-based underwrite flaw was discovered in the way Apache HTTP Server's apr-util library created compiled forms of particular search patterns on Red Hat Enterprise Linux 4. An attacker could formulate a specially-crafted search keyword that would overwrite arbitrary heap memory locatons when processed by the pattern preparation engine. (RHSA-2009:1160)

CVE-2008-5515

In Tomcat 5 and 6 on Red Hat Enterprise Linux 4 and 5, request dispatchers did not properly normalize user requests that had trailing query strings, which allowed remote attackers to send specially-crafted requests that would cause an information leak. (RHSA-2009:1506, RHSA-2009:1454)

CVE-2007-5333

Tomcat 5 did not properly handle a certain character sequence in cookie values on Red Hat Enterprise Linux 4 and 5. A remote attacker could use this flaw to obtain sensitive information, such as session IDs, and use this information for session hijacking attacks. (RHSA-2009:1454)

Note

Version 0 cookies that contain values that must be quoted to be valid are automatically changed to version 1 cookies. To reactivate the previous, but insecure, behavior, add the following entry to /etc/tomcat5/catalina.properties

org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false

Copy to Clipboard Toggle word wrap

CVE-2009-1191

An information disclosure flaw was found in Apache HTTP Server's mod_proxy_ajp module. In certain situations, if a user sent a specially-crafted HTTP request, the httpd server could return a response intended for another user. (RHSA-2009:1058)

JBPAPP-3272

Installing the tomcat5-admin-webapps package resulted in missing dependencies. This made it impossible to access the Tomcat Administration section from http://localhost:8080/. The missing dependency, jakarta-commons-chain, has been added.

JBPAPP-3255

The zip distribution of Enterprise Web Server 1.0 did not contain the administration web application, and directed users to download and install tomcat5-admin-webapps separately. The package is now included in the zip distribution.

JBPAPP-2850

Apache HTTP Server Control Interface (apachectl) required several modifications to work with Enterprise Web Server. The httpd/.postinstall script has been updated to make these modifications automatically.

JBPAPP-2122

The apachectl binary available from the Customer Service Portal for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5 i386 was zero length. The fix for this caused problems with the RPM distribution. This has been corrected.

JBPAPP-1838

When Enterprise Web Server was installed by zip, the httpd/.postinstall script did not modify the conf/httpd.conf file to point to the correct ServerRoot directory.

JBPAPP-1837

Following RPM installation on Red Hat Enterprise Linux 4, the /var/log/httpd22 directory was not automatically created, which forced the httpd startup script to fail. The directory is now created on startup.

JBPAPP-1809

Some Tomcat users would receive a warning that there were no write permissions on the directory. This problem can no longer be reproduced.

JBPAPP-1788

Tomcat 6 on the Solaris operating system stopped at the command /ews/etc/init.d/tomcat6 stop, and though the server terminated successfully, the output displayed command usage errors because the CATALINA_PID variable was not defined in Tomcat 6. CATALINA_PID is now defined and the command usage errors no longer occur.

JBPAPP-1783

Two Tomcat Native libraries, libapr and libaprutil have been included in Enterprise Web Server to prevent problems when running Enterprise Web Server on Red Hat Enterprise Linux 5.

General Known Issues

JBPAPP-3789

Installing both Tomcat 5 and Tomcat 6 rpms causes Tomcat 5 to load the Tomcat 6 servlet JAR, tomcat6-servlet-2.5-api.jar, instead of geronimo-j2ee-1.4-apis.jar. Before Tomcat 6 is installed, Tomcat 5 uses:

/var/lib/tomcat5/common/lib/\[servlet\].jar -> /usr/share/java/servlet.jar -> 
/etc/alternatives/servlet -> /usr/share/java/geronimo-j2ee-1.4-apis.jar

Copy to Clipboard Toggle word wrap

After Tomcat 6 is installed, Tomcat 5 uses:

/var/lib/tomcat5/common/lib/\[servlet\].jar -> /usr/share/java/servlet.jar -> 
/etc/alternatives/servlet -> /usr/share/java/tomcat6-servlet-2.5-api.jar

Copy to Clipboard Toggle word wrap

There are two workarounds to this issue:

1. Install only the Tomcat 6 rpm, and install Tomcat 5 from the zip download.
2. Remove /var/lib/tomcat5/common/lib/\[servlet\].jar and copy geronimo-j2ee-1.4-apis.jar to /var/lib/tomcat5/common/lib/ to achieve the same effect.

JBPAPP-3762

When JBoss Enterprise Web Server is run on the IBM Java Development Kit 1.6 using Java Security Manager, Tomcat 6 does not start.

JBPAPP-3755

The current JBoss ON plugin (v2.3) for JBoss Enterprise Web Server is not supported on Windows or Solaris platforms, and there are several known issues on Red Hat Enterprise Linux. JBoss ON support for JBoss Enterprise Web Server on these platforms is planned for a future release of JBoss ON.

JBPAPP-3753

Undeploying any web application in the /manager and /admin applications causes an infinite loop. We do not currently recommend using the /manager or /admin applications to undeploy applications from your server.

JBPAPP-3735

The Apache HTTP Server module mod_ssl provides an interface to the OpenSSL library, which provides Strong Encryption using the Transport Layer Security/Secure Sockets Layer security protocols. To use this feature, install the mod_ssl package.

JBPAPP-3734

Unless <package>.noarch is specified for Tomcat 5 packages, yum fetches all Tomcat 5 packages from the Red Hat Enterprise Linux 5 base channel instead of the JBoss Enterprise Web Server channel. The installation instructions have been modified to include a work-around for this issue.

JBPAPP-3685

Attempting to edit server configuration details with the Tomcat 5 administration application results in some configuration information being lost from the configuration file (server.xml). At present we do not recommend using the the administration application for Tomcat 5.

JBPAPP-3658

Attempting to delete an existing host with the Tomcat 5 Administration Tool results in a NullPointerException. This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-3646

The Tomcat 6 test suite attempts to compile and execute org.apache.catalina.tomcat.util.http.TestCookies instead of org.apache.tomcat.util.http.TestCookies. This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-3644

Setting SECURITY_MANAGER="true" in sysconfig/tomcat5 or sysconfig/tomcat6 has no effect. To start the server securely, users must start with the -secure flag, like so:

catalina.sh start -secure

Copy to Clipboard Toggle word wrap

This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-3628

When a virtual host is created using the /host-manager/html application, all actions work as expected, but the newly created host is not persistently added to the Tomcat configuration. Only the localhost is listed after server restart. This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-3627

The Host Manager Help link in the /host-manager application leads to a HTTP 404 Error. This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-3626

The links that Tomcat Web Application Manager displays for /host-manager and /manager result in a HTTP 404 Error. To work around this issue, add the following section to the WEB-INF/web.xml descriptor, immediately after the servlet-mapping section:

<welcome-file-list>
   <welcome-file>
      html/
   </welcome-file>
</welcome-file-list>

Copy to Clipboard Toggle word wrap

This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-3625

When Tomcat Native is used upon server shutdown, a "Server accept failed" error occurs because the AJP Connector continues to wait for a client connection during shutdown. This is a problem upstream and is expected to be fixed for JBoss Enterprise Web Server 1.0.2.

JBPAPP-2852

RPM installation shares Java library files. When Enterprise Web Server coexists with Enterprise Application Platform or similar, library version conflicts occur. Only one version (either Enterprise Web Server or Enterprise Application Platform) can exist on one server when RPM installation is used. The workaround for this issue is to yum remove Enterprise Application Platform before installing Enterprise Web Server.

JBPAPP-2655

jaxp_parser_impl.jar and xml-commons-apis.jar are not included in Tomcat 6. This can cause a SAXParseException when parsing XML with a specific encoding (for example, GBK). Tomcat 6 requires JDK5 or higher; these JARs are not included in Tomcat because the JAXP implementation (JAXP 1.3) is built into JDK5. If users require encoding that is not supported by JAXP 1.3, the user must provide an external implementation of that encoding. The workaround for the missing JARs is therefore to copy them from Tomcat 5 into Tomcat 6.

JBPAPP-2150

The presence of a httpd-devel.i386 package in the Red Hat Enterprise Linux 5 base channel means that the httpd-devel may not be properly installed to the Red Hat Enterprise Linux x86_64 from the JBoss Enterprise Web Server channel. The correct way to install this package is to run the following command:

yum install httpd-devel.x86_64

Copy to Clipboard Toggle word wrap

JBPAPP-1966

Apache Tomcat handles SSL encryption and decryption such that browser-httpd communication takes place in HTTPS. However, communication between httpd and JBoss Enterprise Web Server takes place in plain HTTP. By default, redirects will also use HTTP. To use HTTPS redirects, define the following attributes on the JBoss HTTP Connector:

proxyName="www.somedomain.com" proxyPort="443" scheme="https"

Copy to Clipboard Toggle word wrap

If JBoss Enterprise Web Server handles redirect requests for both HTTP and HTTPS, you will need one HTTP connector per protocol.