ESB-2018.0709 - [HP-UX] HP-UX Apache Tomcat 7 Servlet Engine: Multiple vulnerabilities 2018-03-12

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0709
   Security vulnerabilities patched in HP-UX Tomcat-based Servlet Engine
                               12 March 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           HP-UX Apache Tomcat 7 Servlet Engine
Publisher:         Hewlett-Packard
Operating System:  HP-UX
Impact/Access:     Provide Misleading Information -- Remote with User Interaction
                   Unauthorised Access            -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-7674 CVE-2017-5664 

Reference:         ESB-2017.2017
                   ESB-2017.1423

Original Bulletin: 
   https://support.hpe.com/hpsc/doc/public/display?docId=hpesbux03828en_us

- --------------------------BEGIN INCLUDED TEXT--------------------

HPESBUX03828 rev.1 - HP-UX Tomcat-based Servlet Engine, Remote Cache Poisoning
or Security Constraint Bypass

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: hpesbux03828en_us

Version: 1

HPESBUX03828 rev.1 - HP-UX Tomcat-based Servlet Engine, Remote Cache Poisoning
or Security Constraint Bypass
NOTICE: The information in this Security Bulletin should be acted upon as soon
as possible.

Release Date: 2018-03-09

Last Updated: 2018-03-09

- -------------------------------------------------------------------------------

Potential Security Impact: Remote: Bypass Security Restrictions, Disclosure of
Information, Multiple Vulnerabilities, Unauthenticated Disclosure of
Information

Source: Hewlett Packard Enterprise, HPE Product Security Response Team

VULNERABILITY SUMMARY

Security vulnerabilities have been identified in the HP-UX Tomcat-based Servlet
Engine. These vulnerabilities could be exploited remotely to create a Cache
Poisoning or Security Constraint Bypass.

References:

  * PSRT110677
  * CVE-2017-7674 - Tomcat-based Servlet Engine
  * CVE-2017-5664 - Tomcat-based Servlet Engine

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HP-UX Tomcat-based Servlet v.7.x Engine D.7.0.77.01 and earlier

BACKGROUND

CVSS Version 3.0 and Version 2.0 Base Metrics

                                        V3                      V2
  Reference          V3 Vector         Base     V2 Vector      Base
                                      Score                   Score

               CVSS:3.0/AV:N/AC:L/            (AV:N/AC:L/
CVE-2017-5664  PR:N/UI:N/S:U/C:N/I:H  7.5     Au:N/C:N/I:P/   5.0
               /A:N                           A:N)

               CVSS:3.0/AV:N/AC:L/            (AV:N/AC:M/
CVE-2017-7674  PR:N/UI:R/S:U/C:N/I:L  4.3     Au:N/C:N/I:P/   4.3
               /A:N                           A:N)

Information on CVSS is documented in HPE Customer Notice: HPSN-2008-002

RESOLUTION

HPE has provided the following software update to resolve the vulnerabilities
in HP-UX Apache Tomcat 7 Servlet Engine:

Tomcat 7.0.84.01 for HP-UX Release B.11.31 (IPF and PA-RISC)

64 bit Depot: HP_UX_11.31_HPUXWS24ATW-B506-11-31-64.depot
32 bit Depot: HP_UX_11.31_HPUXWS24ATW-B506-11-31-32.depot

Note: The depot file can be found here:

https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumber=
HPUXWSATW506

HISTORY
Version:1 (rev.1) - 9 March 2018 Initial release

Third Party Security Patches: Third party security patches that are to be
installed on systems running Hewlett Packard Enterprise (HPE) software products
should be applied in accordance with the customer's patch management policy.

Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HPE Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hpe.com.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWqXZj4x+lLeg9Ub1AQjgVRAAmWhL9bT0FFmhCgtwso3gf4OrtevXqxBv
v0u8E8bjbS8gYIWLetX5lCJAAlkaVWAvkv6PLZnDIIQEPNwbu2vmRS/ohCvZBFl+
NoehdfYO4vbsgvbVsI6xgEyUh11yM5XAP7qnVhLyyMyWTL9S2kYUInJvk30STkHK
NOqWY4tl2jpWpjJnuEEkI3Uj8ACS5Cw3dPsJquUYv/vGr30aqpRXliO74jmnnrFo
vCptVy46L6BDOf8+rxyCAeur/C4gCVd8rTwZa6ISiyeCKy670S3we/Wa20buWc1Y
3RWv7ViH2GpUliHAyWVYihGFSouRQliv00Mv9RmBlypcazosvDuQnyqa8EE6Q/1w
u+7uU0fm6hs3lMCJsdPzKBVk6oDm5mO3thOni701tcBVAocw3RJ8urM6oRn980Tc
uIdZFyHnnovqgQ44QlY+vlR8TqfZgyUSIb7429lt4FjFqj7+i54rSAmJLjTUMDdT
QDlYEpWE/pnHFzMI2y/o1Q03FGeSnODhwrBWD6M3kvC7qCePo6/01tQzdap41L13
cgHRHcbH7UuN/cwEHORzilvpL8CLVTUTFQdVPqQ5s8IoFtwIeV3ZXpRDX2/vG5PC
KwZ2tDEPNjPOpKQruT3kOUciOiNJIrvx1CtXnWeUIWhBklOjFeJCzzxNzHy3VBi/
TTAZ1WxqcL4=
=iy1p
-----END PGP SIGNATURE-----

« Back to bulletins