PT-2016-6422 · Apache+2 · Apache Tomcat+2

Dawid Golunski · Publicado 2016-10-10 · Atualizado 2023-02-12 · CVE-2016-5425

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tomcat on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions (affected versions not specified)

Description The issue is related to weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Recommendations For Apache Tomcat on affected Linux distributions, consider restricting access to the tomcat group or modifying the permissions of /usr/lib/tmpfiles.d/tomcat.conf to prevent local users from gaining root privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CESA-2016_2046

CVE-2016-5425

ELSA-2016-2046

MGASA-2016-0367

RHSA-2016:2046

RHSA-2016_2046

Produtos afetados

Apache Tomcat

Centos

Red Hat

Referências · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/tomcat_rhel_based_temp_priv_esc.rb · Exploit
• 🔥 https://github.com/Pa55w0rd/CVE-2018-1305 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2018-1304 · Exploit
• 🔥 https://exploit-db.com/exploits/40488 · Exploit
• 🔥 http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html · Exploit
• 🔥 http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html · Exploit
• http://oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=19672 · Nota
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Nota
• http://openwall.com/lists/oss-security/2016/10/27/7 · Nota
• http://openwall.com/lists/oss-security/2016/10/27/10 · Nota
• https://advisories.mageia.org/MGASA-2016-0367.html · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/10/27/9 · Nota
• https://osv.dev/vulnerability/CVE-2016-5425 · Aviso do Fabricante
• http://securityfocus.com/bid/93472 · Nota