==================================================================== CERT-Renater Note d'Information No. 2016/VULN370 _____________________________________________________________________ DATE : 28/10/2016 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Tomcat versions 9, 8.5, 8.0, 7.0, 6.0 prior to 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72, 6.0.47. ===================================================================== http://mail-archives.apache.org/mod_mbox/tomcat-announce/201610.mbox/%3cf924a9ba-4e0e-ff25-0f20-413d57721468@apache.org%3e http://mail-archives.apache.org/mod_mbox/tomcat-announce/201610.mbox/%3c63d6d5f0-32d0-7e09-78b9-c9ea4072bf58, @apache.org%3e http://mail-archives.apache.org/mod_mbox/tomcat-announce/201610.mbox/%3c648c15e9-5996-8dc1-697e-67be5d300c56@apache.org%3e http://mail-archives.apache.org/mod_mbox/tomcat-announce/201610.mbox/%3c928ef4a1-5dc5-a492-8e6a-4dc508a304bf@apache.org%3e http://mail-archives.apache.org/mod_mbox/tomcat-announce/201610.mbox/%3c89c1e7ad-5e9c-d18f-115d-dc8022ce57ae@apache.org%3e ____________________________________________________________________ CVE-2016-0762 Apache Tomcat Realm Timing Attack Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M9 Apache Tomcat 8.5.0 to 8.5.4 Apache Tomcat 8.0.0.RC1 to 8.0.36 Apache Tomcat 7.0.0 to 7.0.70 Apache Tomcat 6.0.0 to 6.0.45 Earlier, unsupported versions may also be affected. Description The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. Mitigation Users of affected versions should apply one of the following mitigations - - Upgrade to Apache Tomcat 9.0.0.M10 or later - - Upgrade to Apache Tomcat 8.5.5 or later - - Upgrade to Apache Tomcat 8.0.37 or later - - Upgrade to Apache Tomcat 7.0.72 or later (Apache Tomcat 7.0.71 has the fix but was not released) - - Upgrade to Apache Tomcat 6.0.47 or later (Apache Tomcat 6.0.46 has the fix but was not released) Credit: This issue was discovered by The Apache Tomcat Security Team. References: [1] http://tomcat.apache.org/security-9.html [2] http://tomcat.apache.org/security-8.html [3] http://tomcat.apache.org/security-7.html [4] http://tomcat.apache.org/security-6.html ____________________________________________________________________ CVE-2016-5018 Apache Tomcat Security Manager Bypass Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M9 Apache Tomcat 8.5.0 to 8.5.4 Apache Tomcat 8.0.0.RC1 to 8.0.36 Apache Tomcat 7.0.0 to 7.0.70 Apache Tomcat 6.0.0 to 6.0.45 Earlier, unsupported versions may also be affected. Description A malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. Mitigation Users of affected versions should apply one of the following mitigations - - Upgrade to Apache Tomcat 9.0.0.M10 or later - - Upgrade to Apache Tomcat 8.5.5 or later - - Upgrade to Apache Tomcat 8.0.37 or later - - Upgrade to Apache Tomcat 7.0.72 or later (Apache Tomcat 7.0.71 has the fix but was not released) - - Upgrade to Apache Tomcat 6.0.47 or later (Apache Tomcat 6.0.46 has the fix but was not released) Credit: This issue was discovered by Alvaro Munoz of the HP Enterprise Security Team and reported responsibly to the Apache Tomcat Security Team. References: [1] http://tomcat.apache.org/security-9.html [2] http://tomcat.apache.org/security-8.html [3] http://tomcat.apache.org/security-7.html [4] http://tomcat.apache.org/security-6.html ____________________________________________________________________ CVE-2016-6794 Apache Tomcat System Property Disclosure Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M9 Apache Tomcat 8.5.0 to 8.5.4 Apache Tomcat 8.0.0.RC1 to 8.0.36 Apache Tomcat 7.0.0 to 7.0.70 Apache Tomcat 6.0.0 to 6.0.45 Earlier, unsupported versions may also be affected. Description When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. Mitigation Users of affected versions should apply one of the following mitigations - - Upgrade to Apache Tomcat 9.0.0.M10 or later - - Upgrade to Apache Tomcat 8.5.5 or later - - Upgrade to Apache Tomcat 8.0.37 or later - - Upgrade to Apache Tomcat 7.0.72 or later (Apache Tomcat 7.0.71 has the fix but was not released) - - Upgrade to Apache Tomcat 6.0.47 or later (Apache Tomcat 6.0.46 has the fix but was not released) Credit: This issue was discovered by the Apache Tomcat Security Team. References: [1] http://tomcat.apache.org/security-9.html [2] http://tomcat.apache.org/security-8.html [3] http://tomcat.apache.org/security-7.html [4] http://tomcat.apache.org/security-6.html ____________________________________________________________________ CVE-2016-6796 Apache Tomcat Security Manager Bypass Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M9 Apache Tomcat 8.5.0 to 8.5.4 Apache Tomcat 8.0.0.RC1 to 8.0.36 Apache Tomcat 7.0.0 to 7.0.70 Apache Tomcat 6.0.0 to 6.0.45 Earlier, unsupported versions may also be affected. Description A malicious web application was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. Mitigation Users of affected versions should apply one of the following mitigations - - Upgrade to Apache Tomcat 9.0.0.M10 or later - - Upgrade to Apache Tomcat 8.5.5 or later - - Upgrade to Apache Tomcat 8.0.37 or later - - Upgrade to Apache Tomcat 7.0.72 or later (Apache Tomcat 7.0.71 has the fix but was not released) - - Upgrade to Apache Tomcat 6.0.47 or later (Apache Tomcat 6.0.46 has the fix but was not released) Credit: This issue was discovered by the Apache Tomcat Security Team. References: [1] http://tomcat.apache.org/security-9.html [2] http://tomcat.apache.org/security-8.html [3] http://tomcat.apache.org/security-7.html [4] http://tomcat.apache.org/security-6.html ____________________________________________________________________ CVE-2016-6797 Apache Tomcat Unrestricted Access to Global Resources Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M9 Apache Tomcat 8.5.0 to 8.5.4 Apache Tomcat 8.0.0.RC1 to 8.0.36 Apache Tomcat 7.0.0 to 7.0.70 Apache Tomcat 6.0.0 to 6.0.45 Earlier, unsupported versions may also be affected. Description The ResourceLinkFactory did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. Mitigation Users of affected versions should apply one of the following mitigations - - Upgrade to Apache Tomcat 9.0.0.M10 or later - - Upgrade to Apache Tomcat 8.5.5 or later - - Upgrade to Apache Tomcat 8.0.37 or later - - Upgrade to Apache Tomcat 7.0.72 or later (Apache Tomcat 7.0.71 has the fix but was not released) - - Upgrade to Apache Tomcat 6.0.47 or later (Apache Tomcat 6.0.46 has the fix but was not released) Credit: This issue was discovered by the Apache Tomcat Security Team. References: [1] http://tomcat.apache.org/security-9.html [2] http://tomcat.apache.org/security-8.html [3] http://tomcat.apache.org/security-7.html [4] http://tomcat.apache.org/security-6.html ========================================================== Serveur de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================== + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: cert@support.renater.fr + ==========================================================