Amazon Linux AMI update for tomcat6

Published: 2016-03-29

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2015-5174 CVE-2015-5345 CVE-2016-0714 CVE-2016-0706
CWE-ID	CWE-22 CWE-200 CWE-94
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Limited directory traversal

EUVDB-ID: #VU261

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-5174

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to incorrect validation of paths in getResource(), getResourceAsStream() and getResourcePaths() methods within ServletContext. A local attacker can bypass security manager restrictions using directory traversal sequences and view directory listing outside the $CATALINA_BASE/webapps folder.

Successful exploitation of the vulnerability may allow a local attacker to obtain names of files and folder on vulnerable system.

Mitigation

Update the affected packages.

noarch:
    tomcat6-jsp-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-6.0.45-1.4.amzn1.noarch
    tomcat6-admin-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-servlet-2.5-api-6.0.45-1.4.amzn1.noarch
    tomcat6-docs-webapp-6.0.45-1.4.amzn1.noarch
    tomcat6-el-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-lib-6.0.45-1.4.amzn1.noarch
    tomcat6-javadoc-6.0.45-1.4.amzn1.noarch

src:
    tomcat6-6.0.45-1.4.amzn1.src

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2016-681.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Directory disclosure

EUVDB-ID: #VU262

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-5345

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was therefore possible for a user to determine if a directory existed or not, even if the user was not permitted to view the directory.

Successful exploitation of the vulnerability may allow a remote attacker to confirm existence of directories on the system.

Mitigation

Update the affected packages.

noarch:
    tomcat6-jsp-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-6.0.45-1.4.amzn1.noarch
    tomcat6-admin-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-servlet-2.5-api-6.0.45-1.4.amzn1.noarch
    tomcat6-docs-webapp-6.0.45-1.4.amzn1.noarch
    tomcat6-el-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-lib-6.0.45-1.4.amzn1.noarch
    tomcat6-javadoc-6.0.45-1.4.amzn1.noarch

src:
    tomcat6-6.0.45-1.4.amzn1.src

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2016-681.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Privilege escalation

EUVDB-ID: #VU264

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-0714

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security manager restriction.

A local attacker, who controls web application, can abuse functionality of StandardManager and PersistentManager to gain control over sessions persistence, stored in files, in database or in custom Sore. Since session persistence is performed by Tomcat code with the permissions assigned to Tomcat internal code, the attacker can place specially crafted object into a session and execute arbitrary code on vulnerable system with elevated privileges.

Successful exploitation of the vulnerability may allow a local attacker to gain elevated privileges on the system.

Mitigation

Update the affected packages.

noarch:
    tomcat6-jsp-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-6.0.45-1.4.amzn1.noarch
    tomcat6-admin-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-servlet-2.5-api-6.0.45-1.4.amzn1.noarch
    tomcat6-docs-webapp-6.0.45-1.4.amzn1.noarch
    tomcat6-el-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-lib-6.0.45-1.4.amzn1.noarch
    tomcat6-javadoc-6.0.45-1.4.amzn1.noarch

src:
    tomcat6-6.0.45-1.4.amzn1.src

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2016-681.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Security Manager bypass

EUVDB-ID: #VU263

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-0706

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

A local attacker, who controls web application, can use StatusManagerServlet, when a security manager was configured, to obtain potentially sensitive information, which belongs to other users. The attacker will be able to obtain a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. This could have exposed sensitive information from other web applications, such as session IDs, to the web application.

Successful exploitation of the vulnerability may allow a local attacker to gain access to potentially sensitive information.

Mitigation

Update the affected packages.

noarch:
    tomcat6-jsp-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-6.0.45-1.4.amzn1.noarch
    tomcat6-admin-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-servlet-2.5-api-6.0.45-1.4.amzn1.noarch
    tomcat6-docs-webapp-6.0.45-1.4.amzn1.noarch
    tomcat6-el-2.1-api-6.0.45-1.4.amzn1.noarch
    tomcat6-webapps-6.0.45-1.4.amzn1.noarch
    tomcat6-lib-6.0.45-1.4.amzn1.noarch
    tomcat6-javadoc-6.0.45-1.4.amzn1.noarch

src:
    tomcat6-6.0.45-1.4.amzn1.src

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2016-681.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.