Apache Tomcat once again exposes a security vulnerability:
Vulnerability:CVE-2011-3190 Apache Tomcat bypass verification and Information Leakage
Severity:Severe
Publisher: Apache Software Foundation
Affected Versions:
- Tomcat 7.0.0 ~ All 7.0.20 versions
- Tomcat 6.0.0 ~ All versions of 6.0.33
- Tomcat 5.5.0 ~ All versions 5.5.33
- Earlier versions that no longer provide support may also be affected.
Apache Tomcat supports the AJP protocol to reverse proxy requests to Tomcat and related data. The role of the AJP protocol is that when a request contains a request body, an unauthorized AJP message containing the first part (or possibly all) of the Request body is sent to Tomcat. In some cases, Tomcat treats the message as a new request instead of a request body. This may cause the attacker to completely control the AJP message and allow the attacker:
- Insert the name of the verified user
- Insert IP addresses of any client (may bypass filtering of any client IP addresses)
- Resulting in chaotic responses between users
The following AJP Connector implementationNot affected:
- Org. apache. jk. server. JkCoyoteHandler (5.5.x-default, 6.0.x-default)
The following AJP Connector implementationWill be affected:
- Org. apache. coyote. ajp. AjpProtocol (6.0.x, 7.0.x-default)
- Org. apache. coyote. ajp. AjpNioProtocol (7.0.x)
- Org. apache. coyote. ajp. AjpAprProtocol (5.5.x, 6.0.x, 7.0.x)
In addition, this problem only applies to the following situations:
- POST request accepted
- Request body not processed
Example: see Https://issues.apache.org/bugzilla/show_bug.cgi? Id = 51698
Solution:
- Upgrade Apache Tomcat to the version that has fixed the problem.
- Install the corresponding patch:-7.0.x Http://svn.apache.org/viewvc? Rev. = 1162958 & view = rev
-6.0.x Http://svn.apache.org/viewvc? Rev. = 1162959 & view = rev
-5.5.x Http://svn.apache.org/viewvc? Rev. = 1162960 & view = rev
- Configure the reverse proxy and Tomcat AJP Connector, and use the requiredSecret attribute.
- Use the org. apache. jk. server. JkCoyoteHandler AJP Connector (not applicable to Tomcat 7.0.x)
VIA Apache.org
