Apache Tomcat System Property Replacement Feature Lets Applications Obtain Potentially Sensitive Information on the Target System
SecurityTracker Alert ID: 1037143|
SecurityTracker URL: http://securitytracker.com/id/1037143
(Links to External Site)
Date: Oct 28 2016
Disclosure of system information|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 6.0.0 to 6.0.45, 7.0.0 to 7.0.70, 8.0.0.RC1 to 8.0.36, 8.5.0 to 8.5.4, 9.0.0.M1 to 9.0.0.M9|
A vulnerability was reported in Apache Tomcat. An application can obtain potentially sensitive information on the target system.|
An application can invoke the system property replacement feature to bypass a configured SecurityManager and read potentially sensitive system properties.
An application can read potentially sensitive system properties.|
The vendor has issued a fix (6.0.47, 7.0.72, 8.0.37, 8.5.5, 9.0.0.M10).|
The vendor advisories are available at:
Vendor URL: tomcat.apache.org/security-8.html (Links to External Site)
Access control error|
|Underlying OS: Linux (Any), UNIX (Any), Windows (Any)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: [oss-security] [SECURITY] CVE-2016-6794 Apache Tomcat Security System Property Disclosure|
CVE-2016-6794 Apache Tomcat System Property Disclosure
Vendor: The Apache Software Foundation
Apache Tomcat 9.0.0.M1 to 9.0.0.M9
Apache Tomcat 8.5.0 to 8.5.4
Apache Tomcat 8.0.0.RC1 to 8.0.36
Apache Tomcat 7.0.0 to 7.0.70
Apache Tomcat 6.0.0 to 6.0.45
Earlier, unsupported versions may also be affected.
When a SecurityManager is configured, a web application's ability to
read system properties should be controlled by the SecurityManager.
Tomcat's system property replacement feature for configuration files
could be used by a malicious web application to bypass the
SecurityManager and read system properties that should not be visible.
Users of affected versions should apply one of the following mitigations
- Upgrade to Apache Tomcat 9.0.0.M10 or later
- Upgrade to Apache Tomcat 8.5.5 or later
- Upgrade to Apache Tomcat 8.0.37 or later
- Upgrade to Apache Tomcat 7.0.72 or later
(Apache Tomcat 7.0.71 has the fix but was not released)
- Upgrade to Apache Tomcat 6.0.47 or later
(Apache Tomcat 6.0.46 has the fix but was not released)
This issue was discovered by the Apache Tomcat Security Team.