PT-2016-7819 · Apache+1 · Tomcat8+3

Publicado 2016-12-02 · Atualizado 2021-06-14 · CVE-2016-9775

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tomcat6 versions 6.0.45+dfsg-1deb7u2 and earlier tomcat6 versions 6.0.45+dfsg-1deb8u0 and earlier tomcat6 versions 6.0.35-1ubuntu3.8 and earlier tomcat7 versions 7.0.28-4+deb7u6 and earlier tomcat7 versions 7.0.56-3+deb8u5 and earlier tomcat7 versions 7.0.52-1ubuntu0.7 and earlier tomcat8 versions 8.0.14-1+deb8u4 and earlier tomcat8 versions 8.0.32-1ubuntu1.2 and earlier tomcat8 versions 8.0.37-1ubuntu0.0 and earlier tomcat8 versions 8.0.38-2ubuntu0 and earlier

Description The issue might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory. This can be demonstrated by a program in the /etc/tomcat8/Catalina/attack directory.

Recommendations For tomcat6 versions 6.0.45+dfsg-1deb7u2 and earlier, update to version 6.0.45+dfsg-1deb7u3 or later. For tomcat6 versions 6.0.45+dfsg-1deb8u0 and earlier, update to version 6.0.45+dfsg-1deb8u1 or later. For tomcat6 versions 6.0.35-1ubuntu3.8 and earlier, update to version 6.0.35-1ubuntu3.9 or later. For tomcat7 versions 7.0.28-4+deb7u6 and earlier, update to version 7.0.28-4+deb7u7 or later. For tomcat7 versions 7.0.56-3+deb8u5 and earlier, update to version 7.0.56-3+deb8u6 or later. For tomcat7 versions 7.0.52-1ubuntu0.7 and earlier, update to version 7.0.52-1ubuntu0.8 or later. For tomcat8 versions 8.0.14-1+deb8u4 and earlier, update to version 8.0.14-1+deb8u5 or later. For tomcat8 versions 8.0.32-1ubuntu1.2 and earlier, update to version 8.0.32-1ubuntu1.3 or later. For tomcat8 versions 8.0.37-1ubuntu0.0 and earlier, update to version 8.0.37-1ubuntu0.1 or later. For tomcat8 versions 8.0.38-2ubuntu0 and earlier, update to version 8.0.38-2ubuntu1 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-9775

DLA-728-1

DLA-729-1

DSA-3738-1

DSA-3739-1

USN-3177-1

USN-3177-2

Produtos afetados

Ubuntu

Tomcat6

Tomcat7

Tomcat8

Referências · 54

• http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html · Nota
• https://ubuntu.com/security/CVE-2016-8745 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/tomcat7 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6816 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9774 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8745 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-0762 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6796 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9775 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9775 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-8735 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01545 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-5388 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3738-1 · Aviso do Fabricante