PT-2014-1444 · Apache+5 · Apache Tomcat+5

Published 2014-03-27 · Updated 2022-05-14 · CVE-2014-0096

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 6.0.40 Apache Tomcat versions 7.x prior to 7.0.53 Apache Tomcat versions 8.x prior to 8.0.4

Description The issue exists due to improper restriction of XSLT stylesheets in the default servlet of Apache Tomcat, allowing remote attackers to bypass security restrictions and read arbitrary files. This is related to an XML External Entity (XXE) issue, where a crafted web application can provide an XML external entity declaration in conjunction with an entity reference. The problem enables a malicious web application to bypass file access constraints imposed by the security manager via the use of external XML entities.

Recommendations For Apache Tomcat versions prior to 6.0.40, update to version 6.0.40 or later. For Apache Tomcat versions 7.x prior to 7.0.53, update to version 7.0.53 or later. For Apache Tomcat versions 8.x prior to 8.0.4, update to version 8.0.4 or later. As a temporary workaround, consider disabling the use of XSLT stylesheets in the default servlet until a patch is available. Restrict access to the default servlet to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-264

CWE-20

Related Identifiers

BDU:2015-00406

CESA-2014_0865

CVE-2014-0096

DSA-3530-1

DSA-3552-1

GHSA-QPRX-Q2R7-3RX6

HPSBUX03102

MGASA-2014-0268

RHSA-2014:0827

RHSA-2014:0834

RHSA-2014:0835

RHSA-2014:0843

RHSA-2014:0865

RHSA-2014_0827

RHSA-2014_0865

USN-2302-1

Affected Products

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

Ubuntu

References · 83

• https://cve.org/CVERecord?id=CVE-2014-0096 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0765.html · Vendor Advisory
• http://debian.org/security/2016/dsa-3552 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00406 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html · Vendor Advisory
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0096 · Security Note
• https://ubuntu.com/security/notices/USN-2302-1 · Vendor Advisory
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0096 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0096 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:052 · Vendor Advisory
• http://tomcat.apache.org/security-8.html · Vendor Advisory
• http://debian.org/security/2016/dsa-3530 · Vendor Advisory