PT-2016-6422 · Apache+2 · Apache Tomcat+2

Dawid Golunski · Published 2016-10-10 · Updated 2023-02-12 · CVE-2016-5425

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tomcat on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions (affected versions not specified)

Description The issue is related to weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Recommendations For Apache Tomcat on affected Linux distributions, consider restricting access to the tomcat group or modifying the permissions of /usr/lib/tmpfiles.d/tomcat.conf to prevent local users from gaining root privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CESA-2016_2046

CVE-2016-5425

ELSA-2016-2046

MGASA-2016-0367

RHSA-2016:2046

RHSA-2016_2046

Affected Products

Apache Tomcat

Centos

Red Hat

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/tomcat_rhel_based_temp_priv_esc.rb · Exploit
• 🔥 https://github.com/Pa55w0rd/CVE-2018-1305 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2018-1304 · Exploit
• 🔥 https://exploit-db.com/exploits/40488 · Exploit
• 🔥 http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html · Exploit
• 🔥 http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html · Exploit
• https://advisories.mageia.org/MGASA-2016-0367.html · Security Note
• https://osv.dev/vulnerability/CVE-2016-5425 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-2046.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5425 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0367 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2046.html · Vendor Advisory
• http://oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=19672 · Note
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Note