McAfee Vulnerability Scan Report shows vulnerablities related to tomcat
![]()
Hi All. Our client had a McAfee Vulnerability Scan over the same machine where we deployed CLM, they have found following vulnerabilities related to the tomcat which is our application server:
1, Apache Tomcat Chunked Request Handling Vulnerability [FID 17880] 2, TLS/SSL RC4 Cipher Suites Information Disclosure Vulnerability [FID 18179] 3, Apache Tomcat Response Request Body Denial of Service [FID 18355] 4, Apache Tomcat Security Manager Bypass [FID 18384] Please guide/suggest me how i can resolve above vulnerabilities, do i need to upgrade Tomcat if yes then to which version i need to upgrade as currently i have the tomcat which comes with the CLM 5.0.2 as a bundled. need your help over this urgently . |
One answer
![]()
I would suggest upgrade to the latest available version of tomcat in the same release. I.e. if Tomcat is 7.0.XX go to tomcat.apache.org, find the most recent package for your platform. You cannot just drop the new version onto the existing one as the CLM setup will be lost. Here's how I've upgraded Tomcat from the default provided in the CLM package:
You can also search google for the exact phrases of all 4 of your entries and find references. e.g.
https://tomcat.apache.org/security-7.html
The RC4 will not be fixed by any upgrade, rather one must exclude (delete) those ciphers in the tomcat/conf/server.xml file.
I'm surprised the McAfee does not also provide a CVE reference which would give more precise descriptions/remediation of its findings.
Comments Dear Kevin Ramer,
Thanks a lot brother for giving me your suggestions will follow them.
No issue i will search for more accurate steps to upgrade Tomcat of CLM
Secondly, regarding RC4 could you please elaborate more like in the "Tomcat/conf/server.xml" file what exactly i need to delete ? what i can not delete ? just a bit more elaboration regarding this would be great for me as it would be first time will be deleting anything from server.xml and if i do anything wrong then it will become another issue for me
To upgrade the Tomcat server, follow the steps in this technote.
ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA" />You need to remove the ones with "RC4" in the name. Dear Both Kevin Ramer & Donald Nong
These are almost the same vulnerabilities detected by McAfee and you should follow Kevin 's suggestions above. You should make yourself more familiar with security concepts to better handle such situation. For example, you should recognize that vulnerabilities are mainly concerning Tomcat. The below articles should be a good start.
|
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.