When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - tomcat: Information Disclosure when using VirtualDirContext (CVE-2017-12616)

  - Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the     server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST     authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
    (CVE-2010-1157)

  - Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with     Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress     refactoring that exposed a potential denial of service on Windows if a web application opened a stream for     an uploaded file but failed to close the stream. The file would never be deleted from disk creating the     possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade     to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. (CVE-2023-42794)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - tomcat: Information Disclosure when using VirtualDirContext (CVE-2017-12616)

  - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the     X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2,     10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This     could result in the user agent transmitting the session cookie over an insecure channel. (CVE-2023-28708)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1738 advisory.

    2023-05-11: CVE-2017-12616 was added to this advisory.

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security     constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a     specially crafted request. (CVE-2017-12616)

    Tomcat: Memory leak (CVE-2022-4132)

    Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting     in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note     that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is     not enabled by default and must be explicitly configured. (CVE-2023-24998)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2020 advisory.

    2023-05-11: CVE-2017-12616 was added to this advisory.

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security     constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a     specially crafted request. (CVE-2017-12616)

    When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the     X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2,     10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This     could result in the user agent transmitting the session cookie over an insecure channel. (CVE-2023-28708)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.81. It is, therefore, affected by multiple vulnerabilities :

 - An unspecified vulnerability when running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialization parameter of the Default to false) makes it possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. (CVE-2017-12615, CVE-2017-12617)

 - When using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. (CVE-2017-12616)

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3665-1 advisory.

    It was discovered that Tomcat incorrectly handled being configured with HTTP PUTs enabled. A remote     attacker could use this issue to upload a JSP file to the server and execute arbitrary code. This issue     only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-12616, CVE-2017-12617)

    It was discovered that Tomcat contained incorrect documentation regarding description of the search     algorithm used by the CGI Servlet to identify which script to execute. This issue only affected Ubuntu     17.10. (CVE-2017-15706)

    It was discovered that Tomcat incorrectly handled en empty string URL pattern in security constraint     definitions. A remote attacker could possibly use this issue to gain access to web application resources,     contrary to expectations. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10.
    (CVE-2018-1304)

    It was discovered that Tomcat incorrectly handled applying certain security constraints. A remote attacker     could possibly access certain resources, contrary to expectations. This issue only affected Ubuntu 14.04     LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-1305)

    It was discovered that the Tomcat CORS filter default settings were insecure and would enable     'supportsCredentials' for all origins, contrary to expectations. (CVE-2018-8014)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* apr: Out-of-bounds array deref in apr_time_exp*() functions (CVE-2017-12613)

* tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)

* tomcat: Information Disclosure when using VirtualDirContext (CVE-2017-12616)

* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

* tomcat-native: Mishandling of client certificates can allow for OCSP check bypass (CVE-2017-15698)

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Tomcat security team discovered that when using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

For Debian 7 'Wheezy', these problems have been fixed in version 7.0.28-4+deb7u15.

We recommend that you upgrade your tomcat7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 7.0.81. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.81_security-7 advisory.

  - When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security     constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a     specially crafted request. (CVE-2017-12616)

  - When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the     readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the     server via a specially crafted request. This JSP could then be requested and any code it contained would     be executed by the server. (CVE-2017-12615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199771	RHEL 6 : tomcat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199713	RHEL 7 : tomcat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195432	RHEL 6 : tomcat (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
175088	Amazon Linux AMI : tomcat7 (ALAS-2023-1738)	Nessus	Amazon Linux Local Security Checks	high
175014	Amazon Linux 2 : tomcat (ALAS-2023-2020)	Nessus	Amazon Linux Local Security Checks	high
112310	Apache Tomcat 7.0.x < 7.0.81 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
110264	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Tomcat vulnerabilities (USN-3665-1)	Nessus	Ubuntu Local Security Checks	critical
107208	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 2 (RHSA-2018:0466)	Nessus	Red Hat Local Security Checks	high
103430	Debian DLA-1108-1 : tomcat7 security update	Nessus	Debian Local Security Checks	high
103329	Apache Tomcat 7.0.0 < 7.0.81 multiple vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2017-12616

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high

high