SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Apache Tomcat Configuration Access Control Flaw Lets Remote Users Bypass Security Manager Restrictions on the Target System
SecurityTracker Alert ID:  1037141
SecurityTracker URL:  http://securitytracker.com/id/1037141
CVE Reference:   CVE-2016-6796   (Links to External Site)
Date:  Oct 28 2016
Impact:   Disclosure of system information, Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.0.0 to 6.0.45, 7.0.0 to 7.0.70, 8.0.0.RC1 to 8.0.36, 8.5.0 to 8.5.4, 9.0.0.M1 to 9.0.0.M9
Description:   A vulnerability was reported in Apache Tomcat. An application can bypass security manager restrictions on the target system.

An application can modify configuration parameters for the JSP Servlet to bypass a configured SecurityManager.

Impact:   An application can bypass a configured SecurityManager.
Solution:   The vendor has issued a fix (6.0.47, 7.0.72, 8.0.37, 8.5.5, 9.0.0.M10).

The vendor advisories are available at:

http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html

Vendor URL:  tomcat.apache.org/security-8.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jun 22 2017 (Red Hat Issues Fix for Red Hat JBoss) Apache Tomcat Configuration Access Control Flaw Lets Remote Users Bypass Security Manager Restrictions on the Target System
Red Hat has issued a fix for Red Hat JBoss for Red Hat Enterprise Linux 5, 6, and 7.
Aug 3 2017 (Red Hat Issues Fix) Apache Tomcat Configuration Access Control Flaw Lets Remote Users Bypass Security Manager Restrictions on the Target System
Red Hat has issued a fix for Red Hat Enterprise Linux 7.



 Source Message Contents

Subject:  [oss-security] [SECURITY] CVE-2016-6796 Apache Tomcat Security Manager Bypass

CVE-2016-6796 Apache Tomcat Security Manager Bypass

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M9
Apache Tomcat 8.5.0 to 8.5.4
Apache Tomcat 8.0.0.RC1 to 8.0.36
Apache Tomcat 7.0.0 to 7.0.70
Apache Tomcat 6.0.0 to 6.0.45
Earlier, unsupported versions may also be affected.

Description
A malicious web application was able to bypass a configured
SecurityManager via manipulation of the configuration parameters for the
JSP Servlet.

Mitigation
Users of affected versions should apply one of the following mitigations
- Upgrade to Apache Tomcat 9.0.0.M10 or later
- Upgrade to Apache Tomcat 8.5.5 or later
- Upgrade to Apache Tomcat 8.0.37 or later
- Upgrade to Apache Tomcat 7.0.72 or later
  (Apache Tomcat 7.0.71 has the fix but was not released)
- Upgrade to Apache Tomcat 6.0.47 or later
  (Apache Tomcat 6.0.46 has the fix but was not released)

Credit:
This issue was discovered by the Apache Tomcat Security Team.

References:
[1] http://tomcat.apache.org/security-9.html
[2] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html
[4] http://tomcat.apache.org/security-6.html
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC