Features and Enhancements in Previous Web Server 6.1 Releases

The features and enhancements in Web Server 6.1 service pack releases prior to Web Server 6.1 SP12 are described in the individual Release Notes documents specific to those releases, available on docs.sun.com at http://docs.sun.com/prod/sjs.websvr61#hic. This section lists the important features and enhancements provided in Web Server 6.1 service pack releases between 6.1 SP11 and the current release:

• Features and Enhancements in 6.1 SP12

Features and Enhancements in 6.1 SP12

Web Server 6.1 SP12 now bundles JDK 1.6.0_17 on Solaris, Linux and Windows platforms. Web Server 6.1 SP12 still supports JDK 5 for backward compatibility. For more information on the supported versions for individual platforms, see J2SE and Java SE Support.

This release contains fixes of important bugs, including the following ones related to security vulnerabilities:

• Bug 6916390 describes the format string vulnerabilities in the WebDAV extensions to the Web Server. These issues may allow remote clients to trigger a Web Server crash, thus resulting in a Denial of Service (DoS) condition. These issues may also allow remote unauthorized users to gain elevated privileges, enabling them to access and modify sensitive files.

• Bug 6916391 describes the buffer overflow issues in the Digest Authentication methods in the Web Server, which may allow remote unprivileged users to crash the Web Server, thus leading to a Denial of Service (DoS) condition. These issues may also lead to execution of arbitrary code with elevated privileges.

• Bug 6916392 describes the heap overflow issue in the HTTP TRACE functionality in the Web Server, which may allow remote unprivileged users to crash the Web Server, thus leading to a Denial of Service (DoS) condition. These issues may also be exploited to gain unauthorized access to sensitive information.

SSL/TLS Vulnerability Fix (CVE-2009-3555)

Web Server 6.1 SP12 is upgraded to include NSS 3.12.5 which provides relief for the SSL/TLS renegotiation vulnerability: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555

This vulnerability is a flaw in the current SSL/TLS renegotiation protocol definition. It is not a bug in the Web Server implementation. Due to this reason, there is no implementation-level fix for this vulnerability. The only workaround is to disable renegotiation entirely in order to protect the Web Server from attack.

Therefore, Web Server 6.1 SP12 disables all use of SSL/TLS renegotiation. If either the client or the Web Server attempt to trigger renegotiation on an existing SSL/TLS session, the connection will fail.

Typically renegotiation was used to obtain a client certificate sometime after the SSL/TLS connection was first established. Web applications which attempt to obtain a client certificate in this fashion will now fail.

Obtaining a client certificate during the initial connection handshake will continue to work correctly. This mode can be configured by setting the client-auth element to 'required' in server.xml:

<http-listener>
   <ssl>
      <client-auth>required</client-auth>
   </ssl>
</http-listener>

A future update of Web Server 6.1 will implement a safe renegotiation protocol as soon as the IETF finalizes the design of the new protocol enhancement. It is possible to re-enable the vulnerable SSL/TLS renegotiation capability by setting the environment variable: NSS_SSL_ENABLE_RENEGOTIATION=1. This mode is known to be vulnerable to attack as described in CVE-2009-3555.