Question

apache tomcat digest身份验证多个安全漏洞怎么更新

Answer 1

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。

Apache Tomcat
7.0.0-7.0.27、6.0.0-6.0.35、5.5.0-5.5.35存在多个安全漏洞，成功利用后可允许攻击者绕过安全限制并执行非法操作。

Description
A weakness and a vulnerability have been reported in Apache
Tomcat, which can be exploited by malicious people to bypass certain security
restrictions and cause a DoS (Denial of Service).

1) An error within the “parseHeaders()” function
(InternalNioInputBuffer.java) when parsing request headers does not properly
verify the permitted size and can be exploited to trigger an OutOfMemoryError
exception via specially crafted headers.

This vulnerability is reported in versions 6.0.0-6.0.35 and 7.0.0-7.0.27.

2) An error within DIGEST authentication mechanism does not properly check
server nonces.

This weakness is reported in versions 5.5.0-5.5.35, 6.0.0-6.0.35, and
7.0.0-7.0.29.

Solution
Update to version 5.5.36, 6.0.36, or 7.0.30.