SB2016021201 - Multiple vulnerabilities in Apache Tomcat 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016021201

SB2016021201 - Multiple vulnerabilities in Apache Tomcat

Published: February 12, 2016 Updated: March 14, 2024

Security Bulletin ID SB2016021201
Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 29% Low 57%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Privilege escalation (CVE-ID: CVE-2016-0714)

The vulnerability allows a local attacker to bypass security manager restriction.

A local attacker, who controls web application, can abuse functionality of StandardManager and PersistentManager to gain control over sessions persistence, stored in files, in database or in custom Sore. Since session persistence is performed by Tomcat code with the permissions assigned to Tomcat internal code, the attacker can place specially crafted object into a session and execute arbitrary code on vulnerable system with elevated privileges.

Successful exploitation of the vulnerability may allow a local attacker to gain elevated privileges on the system.



2) Security Manager bypass (CVE-ID: CVE-2016-0706)

The vulnerability allows a local attacker to obtain potentially sensitive information.

A local attacker, who controls web application, can use StatusManagerServlet, when a security manager was configured, to obtain potentially sensitive information, which belongs to other users. The attacker will be able to obtain a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. This could have exposed sensitive information from other web applications, such as session IDs, to the web application.

Successful exploitation of the vulnerability may allow a local attacker to gain access to potentially sensitive information.


3) Directory disclosure (CVE-ID: CVE-2015-5345)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was therefore possible for a user to determine if a directory existed or not, even if the user was not permitted to view the directory.

Successful exploitation of the vulnerability may allow a remote attacker to confirm existence of directories on the system.


4) Limited directory traversal (CVE-ID: CVE-2015-5174)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to incorrect validation of paths in getResource(), getResourceAsStream() and getResourcePaths() methods within ServletContext. A local attacker can bypass security manager restrictions using directory traversal sequences and view directory listing outside the $CATALINA_BASE/webapps folder.

Successful exploitation of the vulnerability may allow a local attacker to obtain names of files and folder on vulnerable system.


5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2016-0763)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization within the setGlobalContext() method in org/apache/naming/factory/ResourceLinkFactory.java. A remote user can bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.


6) Cross-site request forgery (CVE-ID: CVE-2015-5351)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


7) Session Fixation (CVE-ID: CVE-2015-5346)

The vulnerability allows a remote attacker to compromise accounts of other users.

The vulnerability exists due to an insecure way of handling sessions. A remote attacker can leverage the requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java and hijack web sessions of web application users.


Remediation

Install update from vendor's website.

References