PT-2016-3139 · Apache+3 · Apache Tomcat+3

Pierre Ernst · Published 2016-11-08 · Updated 2025-08-31 · CVE-2016-8735

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.47 Apache Tomcat versions 7.0.0 through 7.0.72 Apache Tomcat versions 8.0.0 through 8.0.38 Apache Tomcat versions 8.5.0 through 8.5.6 Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11

Description The issue allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. This is due to the listener not being updated for consistency with an Oracle patch that affected credential types. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. The JmxRemoteLifecycleListener was not updated to account for the fix, leaving Tomcat installations using this listener vulnerable to remote code execution. API Endpoints are not specified, but the issue involves access to JMX ports. Vulnerable parameters or variables are not explicitly mentioned, but the issue is related to credential types.

Recommendations For Apache Tomcat versions 6.0.0 through 6.0.47, update to version 6.0.48 or later. For Apache Tomcat versions 7.0.0 through 7.0.72, update to version 7.0.73 or later. For Apache Tomcat versions 8.0.0 through 8.0.38, update to version 8.0.39 or later. For Apache Tomcat versions 8.5.0 through 8.5.6, update to version 8.5.7 or later. For Apache Tomcat versions 9.0.0.M1 through 9.0.0.M11, update to version 9.0.0.M12 or later. As a temporary workaround, consider disabling the JmxRemoteLifecycleListener until a patch is available. Restrict access to JMX ports to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2017-2558

BDU:2017-01545

CVE-2016-8735

DLA-728-1

DLA-729-1

DSA-3738-1

DSA-3739-1

GHSA-CW54-59PW-4G8C

MGASA-2016-0417

OPENSUSE-SU-2016_3129-1

OPENSUSE-SU-2016_3144-1

RHSA-2017:0455

RHSA-2017:0456

SUSE-SU-2016:3079-1

SUSE-SU-2016:3081-1

SUSE-SU-2017:1632-1

SUSE-SU-2017:1660-1

USN-3177-1

USN-3177-2

USN-4557-1

USN-7242-1

Affected Products

Alt Linux

Apache Tomcat

Suse

Ubuntu

References · 146

• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Patch
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E · Patch
• https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E · Patch
• https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E · Patch
• https://ubuntu.com/security/CVE-2016-8735 · Vendor Advisory
• https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E · Patch
• http://svn.apache.org/viewvc?view=revision&revision=1767676 · Patch
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html · Patch
• https://ubuntu.com/security/CVE-2016-5018 · Vendor Advisory
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-8735 · Security Note
• http://debian.org/security/2016/dsa-3738 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0455 · Vendor Advisory