PT-2004-2366 · Apache · Apache Tomcat

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1452

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions prior to 5.0.27-r3

Description: The issue allows local users in the tomcat group to execute arbitrary commands as root by modifying the init scripts, which are executed with root privileges despite being owned by the tomcat user and group.

Recommendations: For versions prior to 5.0.27-r3, update to version 5.0.27-r3 or later to resolve the issue. As a temporary workaround, consider restricting write access to the init scripts to prevent modification by local users in the tomcat group.

Fix

Related Identifiers

CVE-2004-1452

Affected Products

Apache Tomcat

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-1452 · Security Note
• http://securityfocus.com/bid/10951 · Patch
• http://secunia.com/advisories/12296 · Patch
• http://gentoo.org/security/en/glsa/glsa-200408-15.xml · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16993 · Note