Multiple vulnerabilities in Apache Tomcat

1) Privilege escalation

EUVDB-ID: #VU264

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-0714

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security manager restriction.

A local attacker, who controls web application, can abuse functionality of StandardManager and PersistentManager to gain control over sessions persistence, stored in files, in database or in custom Sore. Since session persistence is performed by Tomcat code with the permissions assigned to Tomcat internal code, the attacker can place specially crafted object into a session and execute arbitrary code on vulnerable system with elevated privileges.

Successful exploitation of the vulnerability may allow a local attacker to gain elevated privileges on the system.

Mitigation

Install the latest version Apache Tomcat 6.0.45, 7.0.68, 8.0.32 or 9.0.0.M3

Vulnerable software versions

Apache Tomcat: 6.0.0 - 9.0.0-M2

Oracle Solaris: 11.3

Oracle Transportation Management: 6.1 - 6.3.7

Virtual Desktop Infrastructure: 3.5.3

Oracle Linux: 7

CPE2.3

External links

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security Manager bypass

EUVDB-ID: #VU263

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-0706

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

A local attacker, who controls web application, can use StatusManagerServlet, when a security manager was configured, to obtain potentially sensitive information, which belongs to other users. The attacker will be able to obtain a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. This could have exposed sensitive information from other web applications, such as session IDs, to the web application.

Successful exploitation of the vulnerability may allow a local attacker to gain access to potentially sensitive information.

Mitigation

Install the latest version Apache Tomcat 6.0.45, 7.0.68, 8.0.32 or 9.0.0.M3

Vulnerable software versions

Apache Tomcat: 6.0.0 - 9.0.0-M2

Oracle Solaris: 11.3

Oracle Transportation Management: 6.1 - 6.3.7

Virtual Desktop Infrastructure: 3.5.3

Oracle Linux: 7

CPE2.3

External links

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Directory disclosure

EUVDB-ID: #VU262

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-5345

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was therefore possible for a user to determine if a directory existed or not, even if the user was not permitted to view the directory.

Successful exploitation of the vulnerability may allow a remote attacker to confirm existence of directories on the system.

Mitigation

Install the latest version Apache Tomcat 6.0.45, 7.0.68, 8.0.30 or 9.0.0.M3

Vulnerable software versions

Apache Tomcat: 6.0.0 - 9.0.0-M2

: 11.3

Oracle Linux: 7

CPE2.3

External links

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Limited directory traversal

EUVDB-ID: #VU261

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-5174

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to incorrect validation of paths in getResource(), getResourceAsStream() and getResourcePaths() methods within ServletContext. A local attacker can bypass security manager restrictions using directory traversal sequences and view directory listing outside the $CATALINA_BASE/webapps folder.

Successful exploitation of the vulnerability may allow a local attacker to obtain names of files and folder on vulnerable system.

Mitigation

Install the latest version Apache Tomcat 6.0.45, 7.0.65, 8.0.27

Vulnerable software versions

Apache Tomcat: 6.0.0 - 8.0.26

Oracle Linux: 10 - 11.3

Oracle Linux: 5 - 7

CPE2.3

External links

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.65
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.27
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU87534

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-0763

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization within the setGlobalContext() method in org/apache/naming/factory/ResourceLinkFactory.java. A remote user can bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Tomcat: 7.0.0 - 9.0.0-M2

CPE2.3

cpe:2.3:a:apache_foundation:apache_tomcat:8.0.30:*:*:*:*:*:*:*

External links

https://svn.apache.org/viewvc?view=revision&revision=1725931
https://svn.apache.org/viewvc?view=revision&revision=1725929
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://tomcat.apache.org/security-7.html
https://seclists.org/bugtraq/2016/Feb/147
https://svn.apache.org/viewvc?view=revision&revision=1725926
https://www.debian.org/security/2016/dsa-3530
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
https://www.debian.org/security/2016/dsa-3609
https://www.ubuntu.com/usn/USN-3024-1
https://www.debian.org/security/2016/dsa-3552
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
https://www.securityfocus.com/bid/83326
https://access.redhat.com/errata/RHSA-2016:1087
https://rhn.redhat.com/errata/RHSA-2016-1089.html
https://access.redhat.com/errata/RHSA-2016:1088
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
https://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html
https://bto.bluecoat.com/security-advisory/sa118
https://www.securitytracker.com/id/1035069
https://security.gentoo.org/glsa/201705-09
https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://rhn.redhat.com/errata/RHSA-2016-2808.html
https://rhn.redhat.com/errata/RHSA-2016-2807.html
https://rhn.redhat.com/errata/RHSA-2016-2599.html
https://security.netapp.com/advisory/ntap-20180531-0001/
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cross-site request forgery

EUVDB-ID: #VU87536

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-5351

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Apache Tomcat: 7.0.0 - 9.0.0-M1

CPE2.3

cpe:2.3:a:apache_foundation:apache_tomcat:9.0.0-M1:*:*:*:*:*:*:*

External links

https://svn.apache.org/viewvc?view=revision&revision=1720663
https://svn.apache.org/viewvc?view=revision&revision=1720652
https://svn.apache.org/viewvc?view=revision&revision=1720655
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://svn.apache.org/viewvc?view=revision&revision=1720658
https://tomcat.apache.org/security-7.html
https://svn.apache.org/viewvc?view=revision&revision=1720660
https://seclists.org/bugtraq/2016/Feb/148
https://svn.apache.org/viewvc?view=revision&revision=1720661
https://www.debian.org/security/2016/dsa-3530
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
https://www.debian.org/security/2016/dsa-3609
https://www.ubuntu.com/usn/USN-3024-1
https://www.debian.org/security/2016/dsa-3552
https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
https://www.securityfocus.com/bid/83330
https://access.redhat.com/errata/RHSA-2016:1087
https://rhn.redhat.com/errata/RHSA-2016-1089.html
https://access.redhat.com/errata/RHSA-2016:1088
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
https://bto.bluecoat.com/security-advisory/sa118
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
https://www.securitytracker.com/id/1035069
https://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html
https://security.gentoo.org/glsa/201705-09
https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021
https://rhn.redhat.com/errata/RHSA-2016-2808.html
https://rhn.redhat.com/errata/RHSA-2016-2807.html
https://rhn.redhat.com/errata/RHSA-2016-2599.html
https://security.netapp.com/advisory/ntap-20180531-0001/
https://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Session Fixation

EUVDB-ID: #VU87535

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-5346

CWE-ID: CWE-384 - Session Fixation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise accounts of other users.

The vulnerability exists due to an insecure way of handling sessions. A remote attacker can leverage the requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java and hijack web sessions of web application users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Tomcat: 7.0.0 - 9.0.0-M1

CPE2.3

cpe:2.3:a:apache_foundation:apache_tomcat:7.0.65:*:*:*:*:*:*:*

External links

https://svn.apache.org/viewvc?view=revision&revision=1713185
https://bz.apache.org/bugzilla/show_bug.cgi?id=58809
https://svn.apache.org/viewvc?view=revision&revision=1713184
https://svn.apache.org/viewvc?view=revision&revision=1713187
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://svn.apache.org/viewvc?view=revision&revision=1723414
https://tomcat.apache.org/security-7.html
https://svn.apache.org/viewvc?view=revision&revision=1723506
https://seclists.org/bugtraq/2016/Feb/143
https://www.debian.org/security/2016/dsa-3530
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
https://www.debian.org/security/2016/dsa-3609
https://www.ubuntu.com/usn/USN-3024-1
https://www.debian.org/security/2016/dsa-3552
https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
https://rhn.redhat.com/errata/RHSA-2016-2046.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
https://www.securityfocus.com/bid/83323
https://access.redhat.com/errata/RHSA-2016:1087
https://rhn.redhat.com/errata/RHSA-2016-1089.html
https://access.redhat.com/errata/RHSA-2016:1088
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
https://bto.bluecoat.com/security-advisory/sa118
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
https://www.securitytracker.com/id/1035069
https://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html
https://security.gentoo.org/glsa/201705-09
https://rhn.redhat.com/errata/RHSA-2016-2808.html
https://rhn.redhat.com/errata/RHSA-2016-2807.html
https://security.netapp.com/advisory/ntap-20180531-0001/
https://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5174 CVE-2016-0763 CVE-2015-5351 CVE-2015-5346
CWE-ID	CWE-94 CWE-200 CWE-22 CWE-264 CWE-352 CWE-384
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Apache Tomcat Server applications / Web servers Oracle Solaris Operating systems & Components / Operating system Oracle Linux Operating systems & Components / Operating system Oracle Transportation Management Other software / Other software solutions Virtual Desktop Infrastructure Server applications / Virtualization software Other
Vendor	Apache Foundation Oracle