Multiple vulnerabilities in Apache Tomcat

Published: 2016-11-22 13:16:58
Severity Medium
Patch available YES
Number of vulnerabilities 3
CVE ID CVE-2016-6817
CVE-2016-6816
CVE-2016-8735
CVSSv3 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
3.4 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]
7.8 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CWE ID CWE-119
CWE-200
CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software Apache Tomcat
Vulnerable software versions Apache Tomcat 9.0.0.M11
Apache Tomcat 9.0.0.M10
Apache Tomcat 9.0.0.M9
Show more
Vendor URL Apache Foundation

Security Advisory

Discovered vulnerabilities may allow a remote attacker to gain access to potentially sensitive data, cause denial of service and execute arbitrary code on the target system.

1) Denial of service

Description

The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due to boundary error when parsing HTTP/2 headers. A remote attacker can send a specially crafted HTTP/2 header longer than available buffer and trigger infinite loop.

Successful exploitation of the vulnerability may result in denial of service.

Remediation

Update to version 9.0.0.M13.

External links

https://tomcat.apache.org/security-9.html
http://svn.apache.org/viewvc?view=rev&rev=1765794

2) Improper input validation

Description

The vulnerability allows a remote attacker to manipulate HTTP responses.

The vulnerability exists due to incorrect parsing of HTTP requests. A remote attacker can send a specially crafted HTTP request containing specially crafted characters and perform XSS attacks, manipulate HTTP responses or obtain potentially sensitive data, belonging to other sessions.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information, but requires presence of a proxy server, which does not block injected characters.

Remediation

Update to version 6.0.48, 7.0.73, 8.0.39 or 9.0.0.M13

External links

https://tomcat.apache.org/security-6.html
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html

3) Remote code execution

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists within JmxRemoteLifecycleListener listener component due to usage of vulnerable Oracle code, fixed in CVE-2016-3427. A remote unauthenticated attacker with ability to connect to vulnerable listener can execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over vulnerable system.

Remediation

Update to version 6.0.48, 7.0.73, 8.0.39 or 9.0.0.M13

External links

https://tomcat.apache.org/security-6.html
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html

Back to List