A security issue and a vulnerability have been reported in Apache Tomcat, which can be exploited by malicious, local users to bypass certain security restrictions or cause a DoS (Denial of Service).

1) The security issue is caused due to Apache Tomcat not properly verifying sendfile request attributes when running under a security manager, which can be exploited by a malicious web application to bypass intended restrictions and e.g. disclose local files.

2) The vulnerability is caused due to Apache Tomcat not properly handling sendfile request with invalid start and endpoints, which can be exploited to crash the JVM.

Successful exploitation requires that a malicious web application is deployed and a security manager and the HTTP NIO or HTTP APR connector with enabled sendfile is used.

Solution
Update to versions 5.5.34, 6.0.33, or 7.0.19

Provided and/or discovered by
Tomcat Security Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://tomcat.apache.org/security-5.html#To_be_fixed_in_Apache_Tomcat_5.5.34_(not_yet_released)
http://tomcat.apache.org/security-6.html#To_be_fixed_in_Apache_Tomcat_6.0.33_(not_yet_released)
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html#Tomcat%207.0.19%20%28markt%29

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers