OBSOLETE Patch-ID# 114016-08

This revision addresses a patch construction issue.
 
(from 114016-07)
 
7027510 address Tomcat 5.5.30 vulnerabilities
 
(from 114016-06)
 
6765752 Apache Tomcat ships unneeded generated classes and java files
6919686 Tomcat vulnerable for CVE-2009-2901, CVE-2009-2902 and CVE-2009-2693
6968248 Tomcat vulnerable for CVE-2010-2227 and CVE-2010-1157.
 
(from 114016-05)
 
6849727 Tomcat 5.5 vulnerable for several security vulnerabilities
 
(from 114016-04)
 
6828821 CVE-2008-5519 vulnerability in mod_jk
 
(from 114016-03)
 
6755592 update Tomcat to 5.5.27 due to several security problems
 
(from 114016-02)
 
6575001 Tomcat in SFW gate should be upgraded to fix various security vulnerabilities
 
(from 114016-01)
 
4759554 security vulnerability in Tomcat 4.x releases prior to 4.0.3

--------------------------------
 
Please refer to the man pages for instructions on using 'patchadd'
and 'patchrm' commands provided with Solaris.
 
The following example installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/123456-07
 
The following example removes a patch from a standalone system:
 
       example# patchrm 123456-07
 
For additional examples please see the appropriate man pages. Any
other special or non-generic installation instructions should be
described below as special instructions.

-----------------------------
 
None.
 
Tomcat notes:
-------------
 
Install this patch together with Apache 1.3 patch 113146-11.
 
This patch installs Tomcat 5.5 alongside the version which was originally
shipped, version 4.0. After installation, existing applications should be
migrated to the new version and the old version should be decommissioned
(this is strongly recommended as version 4.0 is vulnerable to several
security vulnerabilities).
 
Tomcat 5.5 is installed via patch in following paths
/usr/apache/tomcat55 and /var/apache/tomcat55 (where original version
4.0 remains in /usr/apache/tomcat and /var/apache/tomcat).
 
Tomcat 5.5 is started when the Apache 1.3 Web Server is started,
if the Tomcat 5.5 configuration file
/var/apache/tomcat55/conf/server.xml exists and the Apache 1.3 Web
Server configuration file /etc/apache/httpd.conf includes
/etc/apache/tomcat.conf (this file enables Apache Web Server Tomcat
connector).
 
The existing Tomcat 4.0 is still started, as previously, together
with Apache 1.3 Web Server if the Tomcat 4.0 configuration file
/var/apache/tomcat/conf/server.xml exists and the Apache 1.3 Web
Server configuration file /etc/apache/httpd.conf includes
/etc/apache/tomcat.conf. However, it will now only start if there
is no configuration file for Tomcat 5.5 located at
/var/apache/tomcat55/conf/server.xml.
 
When using Tomcat 4.0 with Apache 1.3 Web Server Tomcat connector
mod_webapp.so you will need also to migrate to mod_jk.so (by
modifying the /etc/apache/tomcat.conf file, which have been
updated during patch install and which contains some limited
documentation in the comments).