While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

The version of Tomcat installed on the remote host is prior to 8.0.42. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.0.42_security-8 advisory.

  - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat     9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the     appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore     possible for that untrusted application to retain a reference to the request or response object and     thereby access and/or modify information associated with another web application. (CVE-2017-5648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.5.12. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.12_security-8 advisory.

  - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat     9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the     appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore     possible for that untrusted application to retain a reference to the request or response object and     thereby access and/or modify information associated with another web application. (CVE-2017-5648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.0.M18. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.0.m18_security-9 advisory.

  - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat     9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the     appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore     possible for that untrusted application to retain a reference to the request or response object and     thereby access and/or modify information associated with another web application. (CVE-2017-5648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.76. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.76_security-7 advisory.

  - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat     9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the     appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore     possible for that untrusted application to retain a reference to the request or response object and     thereby access and/or modify information associated with another web application. (CVE-2017-5648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)

* A vulnerability was discovered in tomcat's handling of pipelined requests when 'Sendfile' was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)

* A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)

* A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3519-1 advisory.

    It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A     remote attacker could use this issue to obtain wrong responses possibly containing sensitive information.
    (CVE-2017-5647)

    It was discovered that Tomcat incorrectly used the appropriate facade object. A malicious application     could possibly use this to bypass Security Manager restrictions. (CVE-2017-5648)

    It was discovered that Tomcat incorrectly handled error pages. A remote attacker could possibly use this     issue to replace or remove the custom error page. (CVE-2017-5664)

    It was discovered that Tomcat incorrectly handled the CORS filter. A remote attacker could possibly use     this issue to perform cache poisoning. (CVE-2017-7674)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Realm implementations did not process the supplied     password if the supplied user name did not exist. This     made a timing attack possible to determine valid user     names. Note that the default configuration includes the     LockOutRealm which makes exploitation of this     vulnerability harder. (CVE-2016-0762)

  - It was discovered that a malicious web application     could bypass a configured SecurityManager via a Tomcat     utility method that was accessible to web applications.
    (CVE-2016-5018)

  - It was discovered that when a SecurityManager was     configured, Tomcat's system property replacement     feature for configuration files could be used by a     malicious web application to bypass the SecurityManager     and read system properties that should not be visible.
    (CVE-2016-6794)

  - It was discovered that a malicious web application     could bypass a configured SecurityManager via     manipulation of the configuration parameters for the     JSP Servlet. (CVE-2016-6796)

  - It was discovered that it was possible for a web     application to access any global JNDI resource whether     an explicit ResourceLink had been configured or not.
    (CVE-2016-6797)

  - A vulnerability was discovered in tomcat. When running     an untrusted application under a SecurityManager it was     possible, under some circumstances, for that     application to retain references to the request or     response objects and thereby access and/or modify     information associated with another web     application.(CVE-2017-5648)

  - A vulnerability was discovered in the error page     mechanism in Tomcat's DefaultServlet implementation. A     crafted HTTP request could cause undesired side     effects, possibly including the removal or replacement     of the custom error page.(CVE-2017-5664)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security constrained bypass in error page mechanism :

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.(CVE-2017-5664 )

Calls to application listeners did not use the appropriate facade object :

A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin.
This permitted client and server side cache poisoning in some circumstances.(CVE-2017-7674)

Security Fix(es) :

  - A vulnerability was discovered in the error page     mechanism in Tomcat's DefaultServlet implementation. A     crafted HTTP request could cause undesired side effects,     possibly including the removal or replacement of the     custom error page. (CVE-2017-5664)

  - A vulnerability was discovered in Tomcat. When running     an untrusted application under a SecurityManager it was     possible, under some circumstances, for that application     to retain references to the request or response objects     and thereby access and/or modify information associated     with another web application. (CVE-2017-5648)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1809 advisory.

    - Resolves: rhbz#1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate     facade object
    - Resolves: rhbz#1441480 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was     used

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)

* A vulnerability was discovered in Tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

This updates includes a rebase from tomcat 8.0.42 up to 8.0.43 which resolves multiple CVEs :

  - rhbz#1441242 CVE-2017-5647 CVE-2017-5648 CVE-2017-5650     CVE-2017-5651 tomcat: various flaws

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201705-09 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tomcat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       obtain sensitive information, bypass protection mechanisms and       authentication restrictions.
    A local attacker, who is a tomcat&rsquo;s system user or belongs to       tomcat&rsquo;s group, could potentially escalate privileges.
  Workaround :

    There is no known workaround at this time.

This update for tomcat fixes the following issues :

  - CVE-2017-5647 Pipelined requests could lead to     information disclosure (bsc#1033448)

  - CVE-2017-5648 Untrusted application could retain     listener leading to information disclosure (bsc#1033447)

  - CVE-2016-8745 shared Processor on Connector code could     lead to information disclosure (bsc#1015119)

This update was imported from the SUSE:SLE-12-SP1:Update and SUSE:SLE-12-SP2:Update update projects.

Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine.

  - CVE-2017-5647     Pipelined requests were processed incorrectly, which     could result in some responses appearing to be sent for     the wrong request.

  - CVE-2017-5648     Some application listeners calls were issued against the     wrong objects, allowing untrusted applications running     under a SecurityManager to bypass that protection     mechanism and access or modify information associated     with other web applications.

Two vulnerabilities were discovered in tomcat7, a servlet and JSP engine.

  - CVE-2017-5647     Pipelined requests were processed incorrectly, which     could result in some responses appearing to be sent for     the wrong request.

  - CVE-2017-5648     Some application listeners calls were issued against the     wrong objects, allowing untrusted applications running     under a SecurityManager to bypass that protection     mechanism and access or modify information associated     with other web applications.

Incorrect handling of pipelined requests when send file was used

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. (CVE-2017-5647)

Calls to application listeners did not use the appropriate facade object

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

The version of Apache Tomcat installed on the remote host is version 7.0.x prior to 7.0.76, 8.0.x prior to 8.0.42, 8.5.x prior to 8.5.12, and 9.0.0.x prior to 9.0.0.M18, and is affected by a flaw in the handling of object references that is triggered when calling certain application listeners. With a specially crafted web application, a local attacker may gain access to information associated with another web application.

ID	Name	Product	Family	Severity
197857	Apache Tomcat 8.0.0.RC1 < 8.0.42	Nessus	Web Servers	critical
197851	Apache Tomcat 8.5.0 < 8.5.12	Nessus	Web Servers	critical
197844	Apache Tomcat 9.0.0.M1 < 9.0.0.M18	Nessus	Web Servers	critical
121120	Apache Tomcat 7.0.0 < 7.0.76	Nessus	Web Servers	critical
112177	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 1 (RHSA-2017:1801)	Nessus	Red Hat Local Security Checks	critical
105687	Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerabilities (USN-3519-1)	Nessus	Ubuntu Local Security Checks	critical
103030	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1192)	Nessus	Huawei Local Security Checks	critical
103029	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1191)	Nessus	Huawei Local Security Checks	critical
102547	Amazon Linux AMI : tomcat7 (ALAS-2017-873)	Nessus	Amazon Linux Local Security Checks	critical
102032	Scientific Linux Security Update : tomcat on SL7.x (noarch) (20170727)	Nessus	Scientific Linux Local Security Checks	critical
102031	Oracle Linux 7 : tomcat (ELSA-2017-1809)	Nessus	Oracle Linux Local Security Checks	critical
102020	CentOS 7 : tomcat (CESA-2017:1809)	Nessus	CentOS Local Security Checks	critical
102012	RHEL 7 : tomcat (RHSA-2017:1809)	Nessus	Red Hat Local Security Checks	critical
101573	Fedora 26 : 1:tomcat (2017-0e64c4c186)	Nessus	Fedora Local Security Checks	critical
100262	GLSA-201705-09 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
100204	openSUSE Security Update : tomcat (openSUSE-2017-586)	Nessus	SuSE Local Security Checks	critical
99972	Debian DSA-3843-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	critical
99971	Debian DSA-3842-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	critical
99720	Fedora 24 : 1:tomcat (2017-d5aa7c77d6)	Nessus	Fedora Local Security Checks	critical
99718	Fedora 25 : 1:tomcat (2017-5261ba4605)	Nessus	Fedora Local Security Checks	critical
99535	Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2017-822)	Nessus	Amazon Linux Local Security Checks	critical
700056	Apache Tomcat 7.0.x < 7.0.76 / 8.0.x < 8.0.42 / 8.5.x < 8.5.12 / 9.0.0.x < 9.0.0.M18 Information Disclosure	Nessus Network Monitor	Web Servers	low

Detections

Analytics

CVE-2017-5648

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

low