Novell Home

My Favorites

Close

Please to see your favorites.

Potential Security vulnerability with Tomcat version reported on Windows based NAM Server error messages

This document (7014122) is provided subject to the disclaimer at the end of this document.

Environment

NetIQ Access Manager 3.2
All NAM components (Admin Console, Identity Server and Access Gateway Service) running on Windows 2008 R2 platform

Situation

Access Manager 3.2.2 setup on Windows 2008 R2 servers and working well.
Sharepoint 2010 (SP2010) setup on Windows 2008 which is accelerated by the Access Gateway (AG)
Administrator wanted to change the setup so that the NAM Identity (IDP)Server would SSO users to SP2010 using ws-federation claims and tokens.

Setup an environment using native SP2010 ws-fed SP to build trust relationship with the NAM
IDP server. When user hits SP2010 and selects the option to sign in, they are redirected to the NAM ws-fed IDP server as expected User then authenticates to IDP server with an x509 certificate After user successfully authenticates to the IDP server, it should try to generate the assertion/claim
to send back to the SP2010 SP However, during the authentication process, the user gets a 500 internal error reported on the browser
because a method cannot be found (misconfiguration) Looking at the request and the error response below, we can see that the tomcat version is divulged,
when it should not be. This only seems to be the issue on Windows as the Linux version does not report
this tomcat version

// Snippet from Microsoft STRACE output on browser) showing the GET request to the IDP server

0000: 47 45 54 20 2f 6e 69 64 70 2f 77 73 66 65 64 2f GET /nidp/wsfed/ 0010: 65 70 3f 73 69 64 3d 30 20 48 54 54 50 2f 31 2e ep?sid=0 HTTP/1. 0020: 31 0d 0a 41 63 63 65 70 74 3a 20 61 70 70 6c 69 1..Accept: appli 0030: 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 61 70 70 6c cation/x-ms-appl 0040: 69 63 61 74 69 6f 6e 2c 20 69 6d 61 67 65 2f 6a ication, image/j 0050: 70 65 67 2c 20 61 70 70 6c 69 63 61 74 69 6f 6e peg, application 0060: 2f 78 61 6d 6c 2b 78 6d 6c 2c 20 69 6d 61 67 65 /xaml+xml, image // NAM IDP responds with 500 internal error: 0000: 48 54 54 50 2f 31 2e 31 20 35 30 30 20 49 6e 74 HTTP/1.1 500 Int 0010: 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 ernal Server Err 0020: 6f 72 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 or..Server: Apac 0030: 68 65 2d 43 6f 79 6f 74 65 2f 31 2e 31 0d 0a 43 he-Coyote/1.1..C 0040: 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 ontent-Type: tex 0050: 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 t/html;charset=u 0060: 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 tf-8..Content-Le 0070: 6e 67 74 68 3a 20 32 35 36 30 0d 0a 44 61 74 65 ngth: 2560..Date 0080: 3a 20 54 75 65 2c 20 31 38 20 44 65 63 20 32 30 : Tue, 18 Dec 20 0090: 31 32 20 31 36 3a 30 38 3a 35 39 20 47 4d 54 0d 12 16:08:59 GMT. 00a0: 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f .Connection: clo 00b0: 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 se....<html><hea 00c0: 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 d><title>Apache 00d0: 54 6f 6d 63 61 74 2f 37 2e 30 2e 32 33 20 2d 20 Tomcat/7.0.23 - 00e0: 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 Error report</ti 00f0: 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 tle><style><!--H 0100: 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 1 {font-family:T 0110: 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 ahoma,Arial,sans : : 0a00: 3c 62 3e 6e 6f 74 65 3c 2f 62 3e 20 3c 75 3e 54 <b>note</b> <u>T 0a10: 68 65 20 66 75 6c 6c 20 73 74 61 63 6b 20 74 72 he full stack tr 0a20: 61 63 65 20 6f 66 20 74 68 65 20 72 6f 6f 74 20 ace of the root 0a30: 63 61 75 73 65 20 69 73 20 61 76 61 69 6c 61 62 cause is availab 0a40: 6c 65 20 69 6e 20 74 68 65 20 41 70 61 63 68 65 le in the Apache 0a50: 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 32 33 20 6c Tomcat/7.0.23 l 0a60: 6f 67 73 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 ogs.</u></p><HR 0a70: 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 size="1" noshade 0a80: 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 ="noshade"><h3>A 0a90: 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 pache Tomcat/7.0 0aa0: 2e 32 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c .23</h3></body>< 0ab0: 2f 68 74 6d 6c 3e /html>
The version of tomcat is reported eg. 7.0.23. This could be used to verify whether there are known vulnerabilities before exploiting the,.


Resolution

Fixed in 4.0 SP1.

For versions needing fix on NAM 3.2 platform, create the following files in the same directory and run the batch file (eg. fix_tomcat_version.bat)

1) a batch file (e.g. fix_tomcat_version.bat) with the following information and run it to update the catalina.jar (contains version string).

@echo off

echo This script will fix potiential serurity vulnerability which discloses tomcat version in the web application response.
@echo.
echo This process may take few mintues to complete.
@echo.
echo please wait.....

include.vbs "fix"

2) create the ServerInfo.properties file with the following

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

server.info=Apache Tomcat
server.number=
server.built=

3) create the install.vbs file with the following


 '* ========================================================================
 '*
 '* Copyright (c) 2013 Unpublished Work of NetIQ Corporation. All Rights Reserved.
 '*
 '* THIS WORK IS AN UNPUBLISHED WORK AND CONTAINS CONFIDENTIAL,
 '* PROPRIETARY AND TRADE SECRET INFORMATION OF NOVELL, INC. ACCESS TO
 '* THIS WORK IS RESTRICTED TO (I) NOVELL, INC. EMPLOYEES WHO HAVE A NEED
 '* TO KNOW HOW TO PERFORM TASKS WITHIN THE SCOPE OF THEIR ASSIGNMENTS AND
 '* (II) ENTITIES OTHER THAN NOVELL, INC. WHO HAVE ENTERED INTO
 '* APPROPRIATE LICENSE AGREEMENTS. NO PART OF THIS WORK MAY BE USED,
 '* PRACTICED, PERFORMED, COPIED, DISTRIBUTED, REVISED, MODIFIED,
 '* TRANSLATED, ABRIDGED, CONDENSED, EXPANDED, COLLECTED, COMPILED,
 '* LINKED, RECAST, TRANSFORMED OR ADAPTED WITHOUT THE PRIOR WRITTEN
 '* CONSENT OF NOVELL, INC. ANY USE OR EXPLOITATION OF THIS WORK WITHOUT
 '* AUTHORIZATION COULD SUBJECT THE PERPETRATOR TO CRIMINAL AND CIVIL
 '* LIABILITY.
 '*
 '* ========================================================================

'This Script fixes the security vulnerability with Tomcat version reported on Windows.
'Note: Script will stop the tomcat and later start after the fix is put in place.



If WScript.Arguments.Count = 1 then

Set Sh=WScript.CreateObject("WScript.Shell")
' msg="This script will update Tomcat's Catalina.jar to fix not to display version in the jsp pages. For this change to take effect, tomcat will have to be restarted. Do you wish to continue ?"


msg="This script will fix potiential serurity vulnerability which discloses tomcat version " & vbCrLf & "This will require updating catalina.jar and tomcat restart. " & vbCrLf & vbCrLf & "Do you want to continue?"

path = "C:\Program Files (x86)\Novell\Tomcat\lib\"
service = "Tomcat"

Set fso = WScript.CreateObject("Scripting.FileSystemObject")

    If (not fso.FileExists(path  & "catalina.jar")) Then
        path = "C:\Program Files\Novell\Tomcat\lib\"
       
        service = "Tomcat"
    end if


If Sh.Popup(msg,0,"Confirm",33)<2 Then

    If (fso.FileExists(path & "catalina.jar")) Then
        backup="Nam_Backup_Catalina.jar"
        action_stop = "stop"
        action_start = "start"
        Sub fileDelete(fname)
            Set fso = WScript.CreateObject("Scripting.FileSystemObject")
            If (fso.FileExists(fname)) Then fso.DeleteFile(fname)
        End Sub
        Sub folderDelete(foldername)
            Set fso = WScript.CreateObject("Scripting.FileSystemObject")
            If (fso.FolderExists(foldername)) Then fso.DeleteFolder(foldername)
        End Sub
        'Stopping the Tomcat Service
        windows_service service,action_stop
        Sub windows_service(service,action)
            Set wmi = GetObject("winmgmts://./root/cimv2")

            qry = "SELECT * FROM Win32_Service WHERE Name like'%" & service & "%'"
            For Each s In wmi.ExecQuery(qry)
              Select Case action
                    Case "start": If s.State = "Stopped" Then
                                    s.StartService
                                    Do Until wmi.ExecQuery(qry & " AND State='Running'").Count > 0
                                        WScript.Sleep 5
                                    Loop
                        End If
                    Case "stop" : If s.State = "Running" Then
                                    s.StopService
                                    Do Until wmi.ExecQuery(qry & " AND State='Stopped'").Count > 0
                                        WScript.Sleep 5
                                    Loop
                             End If
                Case Else : WScript.Echo "Invalid action: " & action
              End Select
            Next
        End Sub
        'Copying the catalina.jar from main location to C drive
        DFile = "C:\Windows\Temp\Catalina.jar"
        SFile = path & "catalina.jar"
        Desti = "C:\Windows\Temp\"
   
        FileCopy DFile,Desti,SFile
   
        Const Jarname = "C:\Windows\Temp\Catalina.jar"
        Const TmpZip = "C:\Windows\Temp\Nam_Catalina.zip"
        fileDelete TmpZip
        fso.MoveFile Jarname, TmpZip
       

        'The location of the zip file.
        ZipFile="C:\Windows\Temp\Nam_Catalina.zip"
        'The folder the contents should be extracted to.
        ExtractTo="C:\Windows\Temp\Nam_Catalina"

        'If the extraction location does not exist create it.
        'Set fso = CreateObject("Scripting.FileSystemObject")
        dim filesys
        Set filesys = CreateObject("Scripting.FileSystemObject")
        folderDelete ExtractTo
        fso.CreateFolder(ExtractTo)

        'Extract the contants of the zip file.
        set objShell = CreateObject("Shell.Application")
        set FilesInZip=objShell.NameSpace(ZipFile).items
        objShell.NameSpace(ExtractTo).CopyHere(FilesInZip)
        DFile = "C:\Windows\Temp\Nam_Catalina\org\apache\catalina\util\ServerInfo.properties"
        SFile = "ServerInfo.properties"
        Desti = "C:\Windows\Temp\Nam_Catalina\org\apache\catalina\util\"
        Set objFSO = CreateObject("Scripting.FileSystemObject")
        substrToFind = "server.info=Apache Tomcat" &vbCrLf _
                &"server.number=" &vbCrLf _
                &"server.built="
        Set objInputFile = objFSO.OpenTextFile(DFile)
        tmpStr = objInputFile.ReadAll
        If InStr(tmpStr,substrToFind) > 0 Then
                
            objInputFile.Close
            folderDelete ExtractTo
            fileDelete ZipFile
            windows_service service,action_start
            Wscript.Echo("Tomcat's catalina.jar is already fixed and hence exiting.")
            Wscript.Quit
        End If
        objInputFile.Close
        'Check to see if the file already exists in the destination folder
   
        FileCopy DFile,Desti,SFile
   
        Sub FileCopy(DestinationFile,Destination,SourceFile)
            Set fso = WScript.CreateObject("Scripting.FileSystemObject")
            If fso.FileExists(DestinationFile) Then
                    'Check to see if the file is read-only
                    If Not fso.GetFile(DestinationFile).Attributes And 1 Then
                        'The file exists and is not read-only we can replace the file.

                        fso.CopyFile SourceFile,Destination , True
                    Else
                        'The file exists and is read-only.
                        'Remove the read-only attribute
                        fso.GetFile(DestinationFile).Attributes = fso.GetFile(DestinationFile).Attributes - 1
                        'Replace the file
                        fso.CopyFile SourceFile, Destination, True
                        'Reapply the read-only attribute
                        fso.GetFile(DestinationFile).Attributes = fso.GetFile(DestinationFile).Attributes + 1
                    End If   
                Else
                    'The file does not exist in the destination folder so copy file to this folder.
                    fso.CopyFile SourceFile,Destination, True
                End If
        End Sub

        ArchiveFolder "C:\Windows\Temp\Nam_NewCatalina.zip", ExtractTo
   
        'Function to Extract the zip file
        Sub ArchiveFolder (zipFile, sFolder)
            With CreateObject("Scripting.FileSystemObject")
                    zipFile = .GetAbsolutePathName(zipFile)
                       sFolder = .GetAbsolutePathName(sFolder)
                        With .CreateTextFile(zipFile, True)
                            .Write Chr(80) & Chr(75) & Chr(5) & Chr(6) & String(18, chr(0))
                    End With
                End With

             With CreateObject("Shell.Application")
                .NameSpace(zipFile).CopyHere .NameSpace(sFolder).Items
                   Do Until .NameSpace(zipFile).Items.Count = _
                        .NameSpace(sFolder).Items.Count
                        WScript.Sleep 1000
                   Loop
                End With
   
        End Sub
       
        folderDelete ExtractTo
        'Taking the backup of old catalina jar and copying the new catalina jar to the location
        Set fso = WScript.CreateObject("Scripting.FileSystemObject")
        fso.MoveFile "C:\Windows\Temp\Nam_NewCatalina.zip", Jarname
        fileDelete backup
        fso.MoveFile TmpZip,backup
        DFile = path & "catalina.jar"
        SFile = "C:\Windows\Temp\Catalina.jar"
        Desti = path
       
        FileCopy DFile,Desti,SFile
        fileDelete SFile
       
        'Restarting the Tomcat Service
        windows_service service,action_start
   
        Wscript.Echo("Tomcat's catalina.jar has been fixed and Tomcat is Restarted." & vbCrLf & "Original catalina.jar is backed up as Nam_Backup_Catalina.jar")    
    Else    
            Wscript.Echo("Tomcat's catalina.jar is not present in location " &path)
    End If
End If

Set sh=nothing
set fso=nothing
Set filesys=nothing
set objShell=nothing
set objFSO=nothing

else

       Wscript.Echo("Please run the script fix_tomcat_version.bat")

End If


Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7014122
  • Creation Date:15-NOV-13
  • Modified Date:15-NOV-13
    • NetIQAccess Manager (NAM)

Did this document solve your problem? Provide Feedback