Test Kennung:	1.3.6.1.4.1.25623.1.0.143312
Kategorie:	Web Servers
Titel:	Apache Tomcat Privilege Escalation Vulnerability (Dec 2019) - Windows
Zusammenfassung:	Apache Tomcat is prone to a privilege escalation vulnerability.
Beschreibung:	Summary: Apache Tomcat is prone to a privilege escalation vulnerability. Vulnerability Insight: When Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. Affected Software/OS: Apache Tomcat 7.0.0 to 7.0.97, 8.5.0 to 8.5.47 and 9.0.0.M1 to 9.0.28. Solution: Update to version 7.0.99, 8.5.49, 9.0.29 or later. As a mitigation disable Tomcat's JmxRemoteLifecycleListener and use the built-in remote JMX facilities provided by the JVM. CVSS Score: 4.4 CVSS Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2019-12418 Bugtraq: 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update (Google Search) https://seclists.org/bugtraq/2019/Dec/43 Debian Security Information: DSA-4596 (Google Search) https://www.debian.org/security/2019/dsa-4596 Debian Security Information: DSA-4680 (Google Search) https://www.debian.org/security/2020/dsa-4680 https://security.gentoo.org/glsa/202003-43 https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E SuSE Security Announcement: openSUSE-SU-2020:0038 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html https://usn.ubuntu.com/4251-1/
Copyright	Copyright (C) 2020 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.