SB2017032908 - Amazon Linux AMI update for tomcat6

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2016-8745)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists to error within the send file code for the NIO HTTP connector, which causes current Processor object being added to the Processor cache multiple times. This behavior means that sharing the same Processor for concurrent requests can lead to leakage of potentially sensitive information between requests, such as session ID, request body, etc.

Successful exploitation of the vulnerability may allow an attacker to obtain potentially sensitive information.

2) Improper input validation (CVE-ID: CVE-2016-6816)

The vulnerability allows a remote attacker to manipulate HTTP responses.

The vulnerability exists due to incorrect parsing of HTTP requests. A remote attacker can send a specially crafted HTTP request containing specially crafted characters and perform XSS attacks, manipulate HTTP responses or obtain potentially sensitive data, belonging to other sessions.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information, but requires presence of a proxy server, which does not block injected characters.

Remediation

Install update from vendor's website.

References

• https://alas.aws.amazon.com/ALAS-2017-810.html