CVE-2013-1976

Los scripts de inicio de (1) tomcat5, (2) tomcat6, y (3) tomcat7, como los usados en las distribuciones RPM de Tomcat para JBoss Enterprise Web Server v1.0.2 y v2.0.0, y Red Hat Enterprise Linux 5 y 6, permite a usuarios locales cambiar el propietario de ficheros a través de un ataque de enlace simbólico sobre a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, o (d) tomcat7-initd.log.

It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to stop responding, resulting in a denial of service. A frame injection in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. A flaw was found in the way the tomcat6 init script handled the tomcat6-initd.log log file. A malicious web application deployed on Tomcat could use this flaw to perform a symbolic link attack to change the ownership of an arbitrary system file to that of the tomcat user, allowing them to escalate their privileges to root. It was discovered that Tomcat incorrectly handled certain authentication requests. A remote attacker could possibly use this flaw to inject a request that would get executed with a victim's credentials. Note: With this update, tomcat6-initd.log has been moved from /var/log/tomcat6/ to the /var/log/ directory.