The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.0.M22. It is, therefore, affected by multiple vulnerabilities:

 - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks. (CVE-2017-7674)

 - A flaw exists in the HTTP/2 implementation that bypasses a number of security checks that prevented directory traversal attacks. A remote attacker can exploit this to bypass security constraints. (CVE-2017-7675)

Note that Nessus Network Monitor has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is version 8.5.x prior to 8.5.16. It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks. (CVE-2017-7674)
 - A flaw exists in the HTTP/2 implementation that bypasses a number of security checks that prevented directory traversal attacks. A remote attacker can exploit this to bypass security constraints. (CVE-2017-7675)

Note that Nessus Network Monitor has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 8.0.x prior to 8.0.45. It is, therefore, affected by a flaw in the CORS filter where the HTTP Vary header is not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks.

Note that Nessus Network Monitor has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 7.0.41 or later but prior to 7.0.79. It is, therefore, affected by a flaw in the CORS filter where the HTTP Vary header is not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks.

Note that Nessus Network Monitor has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 7.0.41 or later but prior to 7.0.79. It is, therefore, affected by a flaw in the CORS filter where the HTTP Vary header is not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks.

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.16. It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks. (CVE-2017-7674)

 - A flaw exists in the HTTP/2 implementation that bypasses a number of security checks that prevented directory traversal attacks. A remote attacker can exploit this to bypass security constraints. (CVE-2017-7675)

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.0.M22. It is, therefore, affected by multiple vulnerabilities :

 - A flaw exists in the CORS filter because the HTTP Vary header was not properly added. This allows a remote attacker to conduct client-side and server-side cache poisoning attacks. (CVE-2017-7674)

 - A flaw exists in the HTTP/2 implementation that bypasses a number of security checks that prevented directory traversal attacks. A remote attacker can exploit this to bypass security constraints. (CVE-2017-7675)

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645)

* A vulnerability was discovered in tomcat's handling of pipelined requests when 'Sendfile' was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)

* A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)

* A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3519-1 advisory.

    It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A     remote attacker could use this issue to obtain wrong responses possibly containing sensitive information.
    (CVE-2017-5647)

    It was discovered that Tomcat incorrectly used the appropriate facade object. A malicious application     could possibly use this to bypass Security Manager restrictions. (CVE-2017-5648)

    It was discovered that Tomcat incorrectly handled error pages. A remote attacker could possibly use this     issue to replace or remove the custom error page. (CVE-2017-5664)

    It was discovered that Tomcat incorrectly handled the CORS filter. A remote attacker could possibly use     this issue to perform cache poisoning. (CVE-2017-7674)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for tomcat fixes the following issues :

Security issues fixed :

  - CVE-2017-5664: A problem in handling error pages was     fixed, to avoid potential file overwrites during error     page handling. (bsc#1042910).

  - CVE-2017-7674: A CORS Filter issue could lead to client     and server side cache poisoning (bsc#1053352)

  - CVE-2017-12617: A remote code execution possibility via     JSP Upload was fixed (bsc#1059554)

Non security bugs fixed :

  - Fix tomcat-digest classpath error (bsc#977410) 

  - Fix packaged /etc/alternatives symlinks for api libs     that caused rpm -V to report link mismatch (bsc#1019016)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in Tomcat's handling of     pipelined requests when 'Sendfile' was used. If     sendfile processing completed quickly, it was possible     for the Processor to be added to the processor cache     twice. This could lead to invalid responses or     information disclosure. (CVE-2017-5647)

  - Two vulnerabilities were discovered in Tomcat where if     a servlet context was configured with readonly=false     and HTTP PUT requests were allowed, an attacker could     upload a JSP file to that context and achieve code     execution. (CVE-2017-12615, CVE-2017-12617)

  - A vulnerability was discovered in Tomcat where the CORS     Filter did not send a 'Vary: Origin' HTTP header. This     potentially allowed sensitive data to be leaked to     other visitors through both client-side and server-side     caches. (CVE-2017-7674)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A vulnerability was discovered in Tomcat's handling of     pipelined requests when 'Sendfile' was used. If sendfile     processing completed quickly, it was possible for the     Processor to be added to the processor cache twice. This     could lead to invalid responses or information     disclosure. (CVE-2017-5647)

  - Two vulnerabilities were discovered in Tomcat where if a     servlet context was configured with readonly=false and     HTTP PUT requests were allowed, an attacker could upload     a JSP file to that context and achieve code execution.
    (CVE-2017-12615, CVE-2017-12617)

  - A vulnerability was discovered in Tomcat where the CORS     Filter did not send a 'Vary: Origin' HTTP header. This     potentially allowed sensitive data to be leaked to other     visitors through both client-side and server-side     caches. (CVE-2017-7674)

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* A vulnerability was discovered in Tomcat's handling of pipelined requests when 'Sendfile' was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)

* Two vulnerabilities were discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12615, CVE-2017-12617)

* A vulnerability was discovered in Tomcat where the CORS Filter did not send a 'Vary: Origin' HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches. (CVE-2017-7674)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3081 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * A vulnerability was discovered in Tomcat's handling of pipelined requests when Sendfile was used. If     sendfile processing completed quickly, it was possible for the Processor to be added to the processor     cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)

    * Two vulnerabilities were discovered in Tomcat where if a servlet context was configured with     readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and     achieve code execution. (CVE-2017-12615, CVE-2017-12617)

    * A vulnerability was discovered in Tomcat where the CORS Filter did not send a Vary: Origin HTTP     header. This potentially allowed sensitive data to be leaked to other visitors through both client-side     and server-side caches. (CVE-2017-7674)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3081 advisory.

    - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
    - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache     poisoning

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

1480618 :

Vary header not added by CORS filter leading to cache poisoning

The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

Two issues were discovered in the Tomcat servlet and JSP engine.

  - CVE-2017-7674     Rick Riemer discovered that the Cross-Origin Resource     Sharing filter did not add a Vary header indicating     possible different responses, which could lead to cache     poisoning.

  - CVE-2017-7675 (stretch only)     Markus Dorschmidt found that the HTTP/2 implementation     bypassed some security checks, thus allowing an attacker     to conduct directory traversal attacks by using     specially crafted URLs.

This update includes a rebase from 8.0.44 up to 8.0.46 which resolves a single CVE along with various other bugs/features :

  - rh#1480620 CVE-2017-7674 tomcat: Cache Poisoning

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 9.0.0.M22. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.0.m22_security-9 advisory.

  - The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of     security checks that prevented directory traversal attacks. It was therefore possible to bypass security     constraints using a specially crafted URL. (CVE-2017-7675)

  - The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to     7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This     permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.16_security-8 advisory.

  - The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of     security checks that prevented directory traversal attacks. It was therefore possible to bypass security     constraints using a specially crafted URL. (CVE-2017-7675)

  - The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to     7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This     permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.0.45. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.0.45_security-8 advisory.

  - The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to     7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This     permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.79. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.79_security-7 advisory.

  - The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to     7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This     permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security constrained bypass in error page mechanism :

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.(CVE-2017-5664 )

Calls to application listeners did not use the appropriate facade object :

A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin.
This permitted client and server side cache poisoning in some circumstances.(CVE-2017-7674)

Security constrained bypass in error page mechanism :

A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin.
This permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

ID	Name	Product	Family	Severity
700702	Apache Tomcat 9.0.x < 9.0.0.M22 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
700691	Apache Tomcat 8.5.x < 8.5.16 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
700685	Apache Tomcat 8.0.x < 8.0.45 Cache Poisoning	Nessus Network Monitor	Web Servers	medium
700673	Apache Tomcat 7.0.41 < 7.0.79 Cache Poisoning Vulnerability	Nessus Network Monitor	Web Servers	medium
112311	Apache Tomcat 7.0.41 < 7.0.79 Cache Poisoning Vulnerability	Web App Scanning	Component Vulnerability	medium
112301	Apache Tomcat 8.5.x < 8.5.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112295	Apache Tomcat 9.0.0.M1 < 9.0.0.M22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
112177	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 1 (RHSA-2017:1801)	Nessus	Red Hat Local Security Checks	critical
105687	Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerabilities (USN-3519-1)	Nessus	Ubuntu Local Security Checks	critical
104765	openSUSE Security Update : tomcat (openSUSE-2017-1299)	Nessus	SuSE Local Security Checks	high
104287	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1262)	Nessus	Huawei Local Security Checks	high
104286	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1261)	Nessus	Huawei Local Security Checks	high
104269	Scientific Linux Security Update : tomcat on SL7.x (noarch) (20171030)	Nessus	Scientific Linux Local Security Checks	high
104257	CentOS 7 : tomcat (CESA-2017:3081)	Nessus	CentOS Local Security Checks	high
104251	RHEL 7 : tomcat (RHSA-2017:3081)	Nessus	Red Hat Local Security Checks	high
104248	Oracle Linux 7 : tomcat (ELSA-2017-3081)	Nessus	Oracle Linux Local Security Checks	high
103600	Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2017-903)	Nessus	Amazon Linux Local Security Checks	medium
103259	Debian DSA-3974-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	high
103235	Fedora 26 : 1:tomcat (2017-ab0def38cd)	Nessus	Fedora Local Security Checks	medium
103234	Fedora 25 : 1:tomcat (2017-a00a087fd4)	Nessus	Fedora Local Security Checks	medium
102590	Apache Tomcat 9.0.0.M1 < 9.0.0.M22 multiple vulnerabilities	Nessus	Web Servers	high
102589	Apache Tomcat 8.5.0 < 8.5.16 multiple vulnerabilities	Nessus	Web Servers	high
102588	Apache Tomcat 8.0.0.RC1 < 8.0.45	Nessus	Web Servers	medium
102587	Apache Tomcat 7.0.41 < 7.0.79	Nessus	Web Servers	medium
102547	Amazon Linux AMI : tomcat7 (ALAS-2017-873)	Nessus	Amazon Linux Local Security Checks	critical
102177	Amazon Linux AMI : tomcat8 (ALAS-2017-862)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2017-7674

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

critical

critical

high

high

high

high

high

high

high

medium

high

medium

medium

high

high

medium

medium

critical

high