Bug 1376712 (CVE-2016-1240)
| Summary: | CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | unspecified | CC: | alee, aszczucz, bbaranow, bdawidow, bmaxwell, ccoleman, cdewolf, chazlett, coolsvap, csutherl, dandread, darran.lofthouse, dedgar, dimitris, dmcphers, dosoudil, epp-bugs, fnasser, gzaronik, hhorak, ivan.afonichev, jason.greene, java-sig-commits, jawilson, jboss-set, jclere, jcoleman, jdg-bugs, jdoyle, jgoulding, jialiu, jokerman, jolee, jondruse, jorton, jpallich, jshepherd, kanderso, krzysztof.daniel, lgao, lmeyer, loleary, mbabacek, mbaluch, mizdebsk, mmccomas, mnewsome, mweiler, myarboro, nobody+bgollahe, nwallace, ohudlick, ppalaga, pslavice, psotirop, rnetuka, rstancel, rsvoboda, rzima, theute, ttarrant, twalsh, vondruch, vtunka, weli | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: |
It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2021-10-21 00:55:14 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 1376716, 1376718, 1470472 | ||||||||
| Bug Blocks: | 1362547, 1428325 | ||||||||
| Attachments: |
|
||||||||
|
Description
Andrej Nemec
2016-09-16 08:38:06 UTC
Debian advisories for tomcat7 and tomcat8 for this CVE: https://www.debian.org/security/2016/dsa-3669 https://www.debian.org/security/2016/dsa-3670 Created attachment 1201569 [details]
Debian patch for tomcat7
Created attachment 1201570 [details]
Debian patch for tomcat8
Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1376716] Created tomcat tracking bugs for this issue: Affects: epel-6 [bug 1376718] This is the flaw description in the Debian packages changelog:
* Fix CVE-2016-1240:
tomcat7.init: Protect /var/log/tomcat7/catalina.out against symlink
attacks and a possible root privilege escalation.
Their init script used to chown catalina.out. Brief look at initscripts for tomcat6 in Red Hat Enterprise Linux 6 and tomcat5 in Red Hat Enterprise Linux 5 suggest those scripts don't do any similar ownership change. chown is only used to set owner of catalina.pid, created in /var/run/, which is not writeable to the tomcat user.
As noted above, Tomcat init scripts in Red Hat Enterprise Linux 5 and 6 do not attempt to chown catalina.out in a directory writeable to the tomcat user. Tomcat packages in Red Hat Enterprise Linux 7 do not use init script, but use systemd service unit file. There are no ownership changed done on Tomcat startup, and any start/stop actions for Tomcat on Red Hat Enterprise Linux 7 are executed directly under tomcat user and group and not with root privileges. Hence Tomcat in Red Hat Enterprise Linux 7 is also unaffected. Note that EPEL-6 tomcat packages are affected by this problem. Reporter's advisory has now been published. External References: http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.txt This issue has been addressed in the following products: Red Hat JBoss Web Server 3.1.0 Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456 This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 6 Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455 Created jbossweb tracking bugs for this issue: Affects: openshift-1 [bug 1470472] |