SB2016121508 - Amazon Linux AMI update for tomcat8
Published: December 15, 2016 Updated: May 12, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2016-6816)
The vulnerability allows a remote attacker to manipulate HTTP responses.
The vulnerability exists due to incorrect parsing of HTTP requests. A remote attacker can send a specially crafted HTTP request containing specially crafted characters and perform XSS attacks, manipulate HTTP responses or obtain potentially sensitive data, belonging to other sessions.
Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information, but requires presence of a proxy server, which does not block injected characters.
2) Remote code execution (CVE-ID: CVE-2016-8735)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists within JmxRemoteLifecycleListener listener component due to usage of vulnerable Oracle code, fixed in CVE-2016-3427. A remote unauthenticated attacker with ability to connect to vulnerable listener can execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to gain complete control over vulnerable system.
Remediation
Install update from vendor's website.