IBM Support

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony

Created by Xing Fang on
Published URL:
https://www.ibm.com/support/pages/node/885114
885114

Security Bulletin


Summary

This interim fix provides instructions on upgrading Apache Tomcat from v6.0.43 to v8.5.41 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address security vulnerabilities CVE-2019-0199 and CVE-2019-10072 in Apache Tomcat.

Vulnerability Details

CVE-ID: CVE-2019-0199
DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by the acceptance of streams with excessive numbers of SETTINGS frames and the permitting of clients to keep streams open without reading/writing request data by the HTTP/2 implementation. By sending excessive SETTINGS frames, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/158637 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2019-10072
DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by HTTP/2 connection window exhaustion on write. By failing to send WINDOW_UPDATE messages, a remote attacker could exploit this vulnerability to block threads on the server and causing a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/162806 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Platform Symphony 7.1 Fix Pack 1

Remediation/Fixes

Applicability
Operating systems: Linux-x86_64
Cluster type: Single grid cluster
Packages

Product APAR Remediation/First Fix
IBM Platform Symphony 7.1 Fix Pack 1 P103017

sym7.1_lnx26-lib23-x64_build521013.tar.gz
Apache Tomcat 8.5.41 N/A

apache-tomcat-8.5.41.tar.gz

For Platform Symphony 7.1 Fix Pack 1

Installation

  1. Log on to the primary host as the cluster administrator and stop the WEBGUI service:
    > egosh user logon -u Admin -x Admin
    > source $EGO_TOP/profile.platform
    > egosh service stop WEBGUI

  2. Log on to each management host in the cluster and back up the following files for recovery purposes:
    $EGO_TOP/gui/3.1/tomcat/
    $EGO_CONFDIR/../../gui/conf/catalina.policy
    $EGO_CONFDIR/../../gui/conf/catalina.properties
    $EGO_CONFDIR/../../gui/conf/server.xml$EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
    $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
    $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
    $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
    $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml

  3. Copy the apache-tomcat-8.5.41.tar.gz package to a temporary folder and decompress the file:
    > cp apache-tomcat-8.5.41.tar.gz /tmp
    > tar zxvf apache-tomcat-8.5.41.tar.gz
    > rm -rf apache-tomcat-8.5.41/conf/
    > rm -rf apache-tomcat-8.5.41/work/
    > rm -rf apache-tomcat-8.5.41/logs/

  4. Copy the Tomcat folder:
    > rm -rf $EGO_TOP/gui/3.1/tomcat
    > cp -rf apache-tomcat-8.5.41 $EGO_TOP/gui/3.1/tomcat

  5. Copy the sym7.1_lnx26-lib23-x64_build521013.tar.gz package and decompress it:
    > tar zxfo sym7.1_lnx26-lib23-x64_build521013.tar.gz -C $EGO_TOP

  6. If you ran the “egoconfig mghost shared_dir” command during installation to set up a shared location for configuration files, ensure that the configuration file is changed in the shared directory:
    > cp $EGO_TOP/gui/conf/catalina.policy $EGO_CONFDIR/../../gui/conf/catalina.policy
    > cp $EGO_TOP/gui/conf/catalina.properties $EGO_CONFDIR/../../gui/conf/catalina.properties
    > cp $EGO_TOP/gui/conf/server.xml $EGO_CONFDIR/../../gui/conf/server.xml

  7. If you modified the $EGO_CONFDIR/../../gui/conf/server.xml configuration file for details such as the GUI service port, manually redo those changes.

  8. Edit the web.xml files to add the following configuration:

    1. Edit each of the following files:
      $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
      $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
      $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml

    2. Find the “<servlet-name>dwr-invoker</servlet-name>” line in the “</servlet>” section and add the following configuration:
      <init-param>
              <param-name>crossDomainSessionSecurity</param-name>
             <param-value>false</param-value>
      </init-param>
      For example:
      <servlet>
          <servlet-name>dwr-invoker</servlet-name>
          <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
                              <init-param>
                       <param-name>debug</param-name>
                   <param-value>true</param-value>
                 </init-param>
                <init-param>
                   <param-name>crossDomainSessionSecurity</param-name>
                   <param-value>false</param-value>
                </init-para      m>
      </servlet>

  9. On each management host, delete all subdirectories and files in the following directory:
    > rm -rf $EGO_TOP/gui/work/*

  10. On all client hosts, open your web browser and clear the browser cache.

  11. Start the WEBGUI service:
    > source $EGO_TOP/profile.platform
    > egosh service start WEBGUI

  12. In the $EGO_TOP/gui/logs/catalina.out file, check whether the GUI version indicates version 8.5.41:
    INFO: Server version:        Apache Tomcat/8.5.41

Uninstallation

Follow the instructions in this section to uninstall this update in your cluster, if required.

  1. Log on to the primary host as the cluster administrator and stop the WEBGUI service:
    > egosh user logon -u Admin -x Admin
    > source $EGO_TOP/profile.platform
    > egosh service stop WEBGUI

  2. On each management host, restore the backup files:

    1. Remove the Tomcat folder, which was introduced by this interim fix:
      > rm -rf $EGO_TOP/gui/3.1/tomcat

    2. Restore the following folders and files from your backup:
      $EGO_TOP/gui/3.1/tomcat
      $EGO_CONFDIR/../../gui/conf/catalina.policy
      $EGO_CONFDIR/../../gui/conf/catalina.properties
      $EGO_CONFDIR/../../gui/conf/server.xml
      $EGO_TOP/gui/ego/3.1/platform/WEB-INF/web.xml
      $EGO_TOP/gui/is/7.1/isgui/WEB-INF/web.xml
      $EGO_TOP/gui/perf/3.1/perfgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/soamgui/WEB-INF/web.xml
      $EGO_TOP/gui/soam/7.1/symgui/WEB-INF/web.xml

  3. Delete all subdirectories and files in the following directory:
    > rm -rf $EGO_TOP/gui/work/*

  4. On all client hosts, open your web browser and clear the browser cache.

  5. Start the WEBGUI service:
    > source $EGO_TOP/profile.platform
    > egosh service start WEBGUI

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None

Change History

21 May 2019: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSGSMK","label":"Platform Symphony"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1 Fix Pack 1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
02 July 2021

UID

ibm10885114

Page Feedback