Detections
Analytics
Amazon Linux AMI : tomcat6 (ALAS-2017-810)
high Nessus Plugin ID 99037
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
It was discovered that the code that parsed the HTTP request line permittedinvalid characters. This could be exploited, in conjunction with a proxy that
also permitted the invalid characters but with a different interpretation, to
inject data into the HTTP response. By manipulating the HTTP response the
attacker could poison a web-cache, perform an XSS attack, or obtain sensitive
information from requests other then their own. (CVE-2016-6816)
Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when
request contains characters that are not permitted by the HTTP specification to
appear not encoded, even though they were previously accepted. The newly
introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow
can be used to configure Tomcat to accept curly braces ({ and }) and the pipe
symbol (|) in not encoded form, as these are often used in URLs without being
properly encoded.
- A bug was discovered in the error handling of the send file code for the NIO
HTTP connector. This led to the current Processor object being added to the
Processor cache multiple times allowing information leakage between requests
including, and not limited to, session ID and the response body.
(CVE-2016-8745)
Solution
Run 'yum update tomcat6' to update your system.See Also
Plugin Details
Severity: High
ID: 99037
File Name: ala_ALAS-2017-810.nasl
Version: 3.7
Type: local
Agent: unix
Published: 3/30/2017
Updated: 4/10/2019
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:tomcat6-jsp-2.1-api, p-cpe:/a:amazon:linux:tomcat6-webapps, p-cpe:/a:amazon:linux:tomcat6-docs-webapp, p-cpe:/a:amazon:linux:tomcat6-el-2.1-api, p-cpe:/a:amazon:linux:tomcat6-lib, p-cpe:/a:amazon:linux:tomcat6-admin-webapps, p-cpe:/a:amazon:linux:tomcat6, cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:tomcat6-javadoc, p-cpe:/a:amazon:linux:tomcat6-servlet-2.5-api
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/29/2017
Reference Information
CVE: CVE-2016-6816, CVE-2016-8745