PT-2004-2366 · Apache · Apache Tomcat

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1452

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions prior to 5.0.27-r3

Description: The issue allows local users in the tomcat group to execute arbitrary commands as root by modifying the init scripts, which are executed with root privileges despite being owned by the tomcat user and group.

Recommendations: For versions prior to 5.0.27-r3, update to version 5.0.27-r3 or later to resolve the issue. As a temporary workaround, consider restricting write access to the init scripts to prevent modification by local users in the tomcat group.

Correção

Identificadores relacionados

CVE-2004-1452

Produtos afetados

Apache Tomcat

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-1452 · Nota de Segurança
• http://securityfocus.com/bid/10951 · Correção
• http://gentoo.org/security/en/glsa/glsa-200408-15.xml · Correção, Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16993 · Nota
• http://secunia.com/advisories/12296 · Correção