An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the Tomcat packages installed configuration file / usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-5425)

* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

* It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. (CVE-2014-7810)

* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)

* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)

Red Hat would like to thank Dawid Golunski (http://legalhackers.com) for reporting CVE-2016-5425 and Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Security Fix(es) :

  - It was discovered that the Tomcat packages installed     certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group.
    A member of the group or a malicious web application     deployed on Tomcat could use this flaw to escalate their     privileges. (CVE-2016-6325)

  - It was found that several Tomcat session persistence     mechanisms could allow a remote, authenticated user to     bypass intended SecurityManager restrictions and execute     arbitrary code in a privileged context via a web     application that placed a crafted object in a session.
    (CVE-2016-0714)

  - It was discovered that tomcat used the value of the     Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which     in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing HTTP     requests. A remote attacker could possibly use this flaw     to redirect HTTP requests performed by a CGI script to     an attacker-controlled proxy via a malicious HTTP     request. (CVE-2016-5388)

  - A directory traversal flaw was found in Tomcat's     RequestUtil.java. A remote, authenticated user could use     this flaw to bypass intended SecurityManager     restrictions and list a parent directory via a '/..' in     a pathname used by a web application in a getResource,     getResourceAsStream, or getResourcePaths call, as     demonstrated by the $CATALINA_BASE/webapps directory.
    (CVE-2015-5174)

  - It was found that Tomcat could reveal the presence of a     directory even when that directory was protected by a     security constraint. A user could make a request to a     directory via a URL not ending with a slash and,     depending on whether Tomcat redirected that request,     could confirm whether that directory existed.
    (CVE-2015-5345)

  - It was found that Tomcat allowed the     StatusManagerServlet to be loaded by a web application     when a security manager was configured. This allowed a     web application to list all deployed web applications     and expose sensitive information such as session IDs.
    (CVE-2016-0706)

Bug Fix(es) :

  - Due to a bug in the tomcat6 spec file, the catalina.out     file's md5sum, size, and mtime attributes were compared     to the file's attributes at installation time. Because     these attributes change after the service is started,     the 'rpm -V' command previously failed. With this     update, the attributes mentioned above are ignored in     the RPM verification and the catalina.out file now     passes the verification check.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0455 advisory.

  - tomcat: timing attack in Realm implementation (CVE-2016-0762)

  - tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation (CVE-2016-1240)

  - tomcat: Usage of vulnerable FileUpload package can result in denial of service (CVE-2016-3092)

  - tomcat: security manager bypass via IntrospectHelper utility function (CVE-2016-5018)

  - tomcat: tomcat writable config files allow privilege escalation (CVE-2016-6325)

  - tomcat: system property disclosure (CVE-2016-6794)

  - tomcat: security manager bypass via JSP Servlet config parameters (CVE-2016-6796)

  - tomcat: unrestricted access to global resources (CVE-2016-6797)

  - tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests     (CVE-2016-6816)

  - tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener (CVE-2016-8735)

  - tomcat: information disclosure due to incorrect Processor sharing (CVE-2016-8745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

来自 Red Hat 安全公告 2016:2046： tomcat 更新现可用于 Red Hat Enterprise Linux 7。 Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 Apache Tomcat 是适用于 Java Servlet 和 JavaServer Pages (JSP) 技术的 servlet 容器。 安全补丁： * 已发现 Tomcat 程序包安装的配置文件 /usr/lib/tmpfiles.d/tomcat.conf，可写入 tomcat 群组。群组中的成员或部署在 Tomcat 上的恶意 Web 应用程序可使用此缺陷，升级其权限。(CVE-2016-5425) * 已发现 Tomcat 程序包安装的由 Tomcat 初始化脚本读取的某些配置文件，可写入 tomcat 群组。群组中的成员或部署在 Tomcat 上的恶意 Web 应用程序可使用此缺陷，升级其权限。(CVE-2016-6325) * 已发现表达式语言解析器对特权代码部分内的表达式求值。恶意 Web 应用程序可利用此缺陷绕过安全管理器保护。(CVE-2014-7810) * 已发现 tomcat 使用 HTTP 请求中 Proxy 标头的值来初始化 CGI 脚本的 HTTP_PROXY 环境变量，而某些 HTTP 客户端实现会不当使用这些变量来配置传出 HTTP 请求的代理。远程攻击者可能利用此缺陷，通过恶意 HTTP 请求，将 CGI 脚本执行的 HTTP 请求重定向到受攻击者控制的代理。(CVE-2016-5388) * 在 Tomcat 回收 requestedSessionSSL 字段的方式中发现一个会话固定缺陷。如果至少有一个 Web 应用程序配置为使用 SSL 会话 ID 作为 HTTP 会话 ID，则攻击者可重复使用之前用过的会话 ID 来提出进一步请求。(CVE-2015-5346) Red Hat 在此感谢 Dawid Golunski (http://legalhackers.com) 报告 CVE-2016-5425 以及 Scott Geary (VendHQ) 报告 CVE-2016-5388。CVE-2016-6325 问题由 Red Hat 产品安全团队发现。

tomcat 的更新现在可用于 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。Apache Tomcat 是适用于 Java Servlet 和 JavaServer Pages (JSP) 技术的 servlet 容器。安全修复：* 已发现 Tomcat 程序包安装的配置文件 /usr/lib/tmpfiles.d/tomcat.conf，可写入 tomcat 群组。群组中的成员或部署在 Tomcat 上的恶意 Web 应用程序可使用此缺陷，升级其权限。(CVE-2016-5425) * 已发现 Tomcat 程序包安装的由 Tomcat 初始化脚本读取的某些配置文件，可写入 tomcat 群组。群组中的成员或部署在 Tomcat 上的恶意 Web 应用程序可使用此缺陷，升级其权限。(CVE-2016-6325) * 已发现表达式语言解析器对特权代码部分内的表达式求值。恶意 Web 应用程序可利用此缺陷绕过安全管理器保护。(CVE-2014-7810) * 已发现 tomcat 使用 HTTP 请求中 Proxy 标头的值来初始化 CGI 脚本的 HTTP_PROXY 环境变量，而某些 HTTP 客户端实现会不当使用这些变量来配置传出 HTTP 请求的代理。远程攻击者可能利用此缺陷，通过恶意 HTTP 请求，将 CGI 脚本执行的 HTTP 请求重定向到受攻击者控制的代理。(CVE-2016-5388) * 在 Tomcat 回收 requestedSessionSSL 字段的方式中发现会话固定缺陷。如果至少有一个 Web 应用程序配置为使用 SSL 会话 ID 作为 HTTP 会话 ID，则攻击者可重复使用之前用过的会话 ID 来提出进一步请求。(CVE-2015-5346) Red Hat 在此感谢 Dawid Golunski (http://legalhackers.com) 报告 CVE-2016-5425 以及 Scott Geary (VendHQ) 报告 CVE-2016-5388。CVE-2016-6325 问题由 Red Hat 产品安全团队发现。

来自 Red Hat 安全公告 2016:2045： tomcat6 更新现可用于 Red Hat Enterprise Linux 6。 Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 Apache Tomcat 是适用于 Java Servlet 和 JavaServer Pages (JSP) 技术的 servlet 容器。 安全补丁： * 已发现 Tomcat 程序包安装的由 Tomcat 初始化脚本读取的某些配置文件，可写入 tomcat 群组。群组中的成员或部署在 Tomcat 上的恶意 Web 应用程序可使用此缺陷，升级其权限。(CVE-2016-6325) * 已发现多个 Tomcat 会话持久性机制可允许经认证的远程用户通过 Web 应用程序，在会话中放置构建的对象，绕过预期的 SecurityManager 限制，并在特权上下文中执行任意代码。(CVE-2016-0714) * 已发现 tomcat 使用 HTTP 请求中 Proxy 标头的值来初始化 CGI 脚本的 HTTP_PROXY 环境变量，而某些 HTTP 客户端实现会不当使用这些变量来配置传出 HTTP 请求的代理。远程攻击者可能利用此缺陷，通过恶意 HTTP 请求，将 CGI 脚本执行的 HTTP 请求重定向到受攻击者控制的代理。(CVE-2016-5388) * 在 Tomcat 的 RequestUtil.java 中发现一个目录遍历缺陷。经身份验证的远程用户可利用此缺陷，绕过预期 SecurityManager 限制，并通过 Web 应用程序在 getResource、getResourceAsStream 或 getResourcePaths 调用中使用的路径名的“/..”来列出父目录，$CATALINA_BASE/webapps 目录即为一例。(CVE-2015-5174) * 已发现即使目录受到安全限制保护，Tomcat 仍可泄露该目录的存在。用户可通过不以斜线结尾的 URL 来请求某目录，且可确认该目录是否存在（根据 Tomcat 是否重定向该请求）。(CVE-2015-5345) * 已发现当配置了安全管理员时，Tomcat 允许 Web 应用程序加载 StatusManagerServlet。 这允许 Web 应用程序列出所有已部署的 Web 应用程序，并泄露会话 ID 等敏感信息。(CVE-2016-0706) Red Hat 在此感谢 Scott Geary (VendHQ) 报告 CVE-2016-5388。CVE-2016-6325 问题由 Red Hat 产品安全团队发现。 缺陷补丁： * 由于 tomcat6 规范文件中的缺陷，所以在安装时会将 catalina.out 文件的 md5sum、大小、mtime 属性与该文件属性进行比较。由于这些属性在服务开始后发生更改，所以之前的“rpm -V”命令失败。通过此更新，在 RPM 验证中会忽略上述属性，且 catalina.out 文件现已通过验证检查。(BZ#1357123)

ID	Name	Product	Family	Published	Updated	Severity
93966	CentOS 7 : tomcat (CESA-2016:2046) (httpoxy)	Nessus	CentOS Local Security Checks	10/12/2016	1/4/2021	high
94004	Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20161010) (httpoxy)	Nessus	Scientific Linux Local Security Checks	10/12/2016	1/14/2021	high
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	3/8/2017	4/24/2024	critical
93948	Oracle Linux 7 : tomcat (ELSA-2016-2046) (httpoxy)	Nessus	Oracle Linux Local Security Checks	10/11/2016	1/14/2021	high
93951	RHEL 7 : tomcat (RHSA-2016:2046) (httpoxy)	Nessus	Red Hat Local Security Checks	10/11/2016	10/24/2019	high
93947	Oracle Linux 6 : tomcat6 (ELSA-2016-2045) (httpoxy)	Nessus	Oracle Linux Local Security Checks	10/11/2016	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

critical

high

high

high