SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Apache Tomcat Bug Lets Remote Users Upload and Execute Arbitrary Code in Certain Cases
SecurityTracker Alert ID:  1030834
SecurityTracker URL:  http://securitytracker.com/id/1030834
CVE Reference:   CVE-2013-4444   (Links to External Site)
Date:  Sep 10 2014
Impact:   Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.0.0 to 7.0.39
Description:   A vulnerability was reported in Apache Tomcat. A remote user can execute arbitrary code on the target system in certain cases.

A remote user can upload arbitrary JSP code and then cause the code to be executed in certain limited cases.

Systems with all of the following conditions are affected:

- A version of Java where 'java.io.File' contains a null byte injection flaw (e.g., 1.7.0 update 25 or prior)

- A web application using the Servlet 3.0 File Upload feature or using Apache Commons File Upload 1.2.1 or prior

- A Tomcat-writable file location within a deployed web application (when the Servlet 3.0 File Upload feature is used)

- A custom listener for JMX connections (e.g., the JmxRemoteListener) configured and able to load classes from Tomcat's common class loader and bound to an address other than localhost

Pierre Ernst of the VMware Security Engineering, Communications & Response group (vSECR) reported this vulnerability (via the Pivotal security team).

Impact:   A remote user can upload and execute arbitrary code on the target system.
Solution:   The vendor has issued a fix (7.0.40) [in May 2013].
Vendor URL:  tomcat.apache.org/security-7.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 17 2015 (IBM Issues Fix for IBM Power Hardware Management Console) Apache Tomcat Bug Lets Remote Users Upload and Execute Arbitrary Code in Certain Cases
IBM has issued a fix for IBM Power Hardware Management Console.
Oct 16 2015 (HP Issues Fix for HP OpenVMS) Apache Tomcat Bug Lets Remote Users Upload and Execute Arbitrary Code in Certain Cases
HP has issued a fix for HP OpenVMS.



 Source Message Contents

Subject:  [SECURITY] CVE-2013-4444 Remote Code Execution in Apache Tomcat

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2013-4444 Remote Code Execution

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- - Apache Tomcat 7.0.0 to 7.0.39

Description:
In very limited circumstances, it was possible for an attacker to upload
a malicious JSP to a Tomcat server and then trigger the execution of
that JSP. While Remote Code Execution would normally be viewed as a
critical vulnerability, the circumstances under which this is possible
are, in the view of the Tomcat security team, sufficiently limited that
this vulnerability is viewed as important.
For this attack to succeed all of the following requirements must be met:
a) Using Oracle Java 1.7.0 update 25 or earlier (or any other Java
   implementation where java.io.File is vulnerable to null byte
   injection).
b) A web application must be deployed to a vulnerable version of Tomcat
   (see previous section).
c) The web application must use the Servlet 3.0 File Upload feature.
d) A file location within a deployed web application must be writeable
   by the user the Tomcat process is running as. The Tomcat security
   documentation recommends against this.
e) A custom listener for JMX connections (e.g. the JmxRemoteListener
   that is not enabled by default) must be configured and be able to
   load classes from Tomcat's common class loader (i.e. the custom JMX
   listener must be placed in Tomcat's lib directory)
f) The custom JMX listener must be bound to an address other than
   localhost for a remote attack (it is bound to localhost by default).
   If the custom JMX listener is bound to localhost, a local attack
   will still be possible.

Note that requirements b) and c) may be replaced with the following
requirement:
g) A web application is deployed that uses Apache Commons File Upload
   1.2.1 or earlier.
In this case a similar vulnerability may exist on any Servlet container,
not just Apache Tomcat.

Mitigation:
This vulnerability may be mitigated by using any one of the following
mitigations:
- - Upgrade to Oracle Java 1.7.0 update 40 or later (or any other Java
  implementation where java.io.File is not vulnerable to null byte
  injection).
- - Use OS file permissions to prevent the process Tomcat is running as
  from writing to any location within a deployed application.
- - Disable any custom JMX listeners
- - Upgrade to Apache Tomcat 7.0.40 or later

Credit:
This issue was identified by Pierre Ernst of the VMware Security
Engineering, Communications & Response group (vSECR)  and reported to
the Tomcat security team via the Pivotal security team.

References:
[1] http://tomcat.apache.org/security-7.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJUEFl4AAoJEBDAHFovYFnnR3cQAL034ZrbUeBcJ4zotNp5+ea2
llNatC3MUlg/vZ2qG8Qo4xxbdS4F53cpu90fFhKm+dFzIiRhZeHROYDv6Lu1biSu
Nvq0YXV6KVJ9Js4G6HFilhy3vownvn/hMAjzmPojSYjWO5slXNfFvAlwyRrGt0Cp
t5rUh4QNavhgO4m0HXJJLg+PNlSKsnGdra+0gWmq8YKtKotgu24SbPq/p3HP7TuJ
nnMjx4A6r2LcoghL/nFAPp2ZwgBCtm67osObJ1uMxYhZ2I/3MztFYpSKvfVONuUK
rL265wmrKLvvDdozd/Aw2d2poXdSO/oWeuhKbbzYOxpUT6iRzf+BkPUR99e6Rqso
lOfLoAYuzYfK4rW/ooxVNKnHMhs+0BVfNZoclKCDSvz+a9dIVS5XD6KcyJQ3uv12
ujyTGaGhLuS/ciAVS372Dx8H0/mfd5nZCkYL6NDyzSWSmb5eG4XxqrLi77yByvAT
ulSAyg1UWk8sRgQ4AY3belH3jDiN1rHSWJAaB+WVwszQdCe4iXgDyB1u4ES22oAN
Ymrg5l7tLQ8/9LyMvlQ0tE4f+OYE6kki6e4JMc2cMqPL/rcjiUnLWZ7YUyx92RM1
LRt9QhMd1h3Uwle7a7LxqJCGf/rIPwRmrjTYYWt43np1Adx7y2RuZOTDjEY98sN3
oCLjuSCalVcBX9hGaJ7n
=98BB
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC