Test Kennung:	1.3.6.1.4.1.25623.1.0.811703
Kategorie:	Web Servers
Titel:	Apache Tomcat Security Bypass and Information Disclosure Vulnerabilities - Linux
Zusammenfassung:	Apache Tomcat is prone to security bypass and information disclosure vulnerabilities.
Beschreibung:	Summary: Apache Tomcat is prone to security bypass and information disclosure vulnerabilities. Vulnerability Insight: Multiple flaws exist due to: - An error in the system property replacement feature for configuration files. - An error in the realm implementations in Apache Tomcat that does not process the supplied password if the supplied user name did not exist. - An error in the configured SecurityManager via a Tomcat utility method that is accessible to web applications. - An error in the configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. - An error in the ResourceLinkFactory implementation in Apache Tomcat that does not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Vulnerability Impact: Successful exploitation will allow remote attackers to gain access to potentially sensitive information and bypass certain security restrictions. Affected Software/OS: Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, Apache Tomcat versions 8.5.0 to 8.5.4, Apache Tomcat versions 8.0.0.RC1 to 8.0.36, Apache Tomcat versions 7.0.0 to 7.0.70, and Apache Tomcat versions 6.0.0 to 6.0.45 on Linux. Solution: Upgrade to Apache Tomcat version 9.0.0.M10 or 8.5.5 or 8.0.37 or 7.0.72 or 6.0.47 or later. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6794 BugTraq ID: 93943 http://www.securityfocus.com/bid/93943 https://security.netapp.com/advisory/ntap-20180605-0001/ Debian Security Information: DSA-3720 (Google Search) http://www.debian.org/security/2016/dsa-3720 https://www.oracle.com/security-alerts/cpuoct2021.html https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb@%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E RedHat Security Advisories: RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455 RedHat Security Advisories: RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456 RedHat Security Advisories: RHSA-2017:0457 http://rhn.redhat.com/errata/RHSA-2017-0457.html RedHat Security Advisories: RHSA-2017:2247 https://access.redhat.com/errata/RHSA-2017:2247 http://www.securitytracker.com/id/1037143 https://usn.ubuntu.com/4557-1/ Common Vulnerability Exposure (CVE) ID: CVE-2016-0762 BugTraq ID: 93939 http://www.securityfocus.com/bid/93939 https://www.oracle.com//security-alerts/cpujul2021.html https://lists.apache.org/thread.html/1872f96bad43647832bdd84a408794cd06d9cbb557af63085ca10009@%3Cannounce.tomcat.apache.org%3E http://www.securitytracker.com/id/1037144 Common Vulnerability Exposure (CVE) ID: CVE-2016-5018 BugTraq ID: 93942 http://www.securityfocus.com/bid/93942 http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e@%3Cannounce.tomcat.apache.org%3E RedHat Security Advisories: RHSA-2017:1548 https://access.redhat.com/errata/RHSA-2017:1548 RedHat Security Advisories: RHSA-2017:1549 https://access.redhat.com/errata/RHSA-2017:1549 RedHat Security Advisories: RHSA-2017:1550 https://access.redhat.com/errata/RHSA-2017:1550 RedHat Security Advisories: RHSA-2017:1551 http://rhn.redhat.com/errata/RHSA-2017-1551.html RedHat Security Advisories: RHSA-2017:1552 https://access.redhat.com/errata/RHSA-2017:1552 http://www.securitytracker.com/id/1037142 http://www.securitytracker.com/id/1038757 Common Vulnerability Exposure (CVE) ID: CVE-2016-6796 BugTraq ID: 93944 http://www.securityfocus.com/bid/93944 https://lists.apache.org/thread.html/5a2105a56b2495ab70fa568f06925bd861f0d71ffab4fb38bb4fdc45@%3Cannounce.tomcat.apache.org%3E http://www.securitytracker.com/id/1037141 Common Vulnerability Exposure (CVE) ID: CVE-2016-6797 BugTraq ID: 93940 http://www.securityfocus.com/bid/93940 https://lists.apache.org/thread.html/9325837eb00cba5752c092047433c7f0415134d16e7f391447ff4352@%3Cannounce.tomcat.apache.org%3E http://www.securitytracker.com/id/1037145
Copyright	Copyright (C) 2017 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.