Bug 1397485 (CVE-2016-8735)
Summary: | CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | aileenc, alee, apmukher, aszczucz, bbaranow, bdawidow, bihu, bmaxwell, ccoleman, cdewolf, chazlett, coolsvap, csutherl, dandread, darran.lofthouse, dedgar, dmcphers, dosoudil, epp-bugs, fnasser, gzaronik, hhorak, huwang, ivan.afonichev, jason.greene, java-sig-commits, jawilson, jboss-set, jclere, jcoleman, jdg-bugs, jdoyle, jgoulding, jialiu, joelsmith, jokerman, jolee, jorton, jpallich, jshepherd, kanderso, krzysztof.daniel, lgao, lmeyer, mbabacek, mbaluch, mizdebsk, mmccomas, mmiura, mnewsome, mweiler, myarboro, nobody+bgollahe, nwallace, ohudlick, pslavice, rfreire, rnetuka, rsvoboda, rzima, theute, ttarrant, twalsh, vondruch, vtunka, weli, yozone |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | tomcat 6.0.48, tomcat 7.0.73, tomcat 8.0.39, tomcat 8.5.8 | Doc Type: | If docs needed, set a value |
Doc Text: |
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-27 10:53:45 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1397493, 1397495, 1397496, 1398263, 1398264, 1399020, 1399021, 1402657, 1402658, 1402659, 1402660 | ||
Bug Blocks: | 1397488, 1397645, 1428325, 1482229 |
Description
Adam Mariš
2016-11-22 15:56:47 UTC
Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1397493] Affects: epel-6 [bug 1397495] Although Fuse-6 is marked as not affected by this issue. We created a new CVE for that product because it does not use JMXRemoteLifecycleListner, and this issue has 'tomcat' in the title. It's been assigned CVE-2016-8653. EAP 6 is not affected by this issue. Here is the stacktrace which I get when trying the exploit there: INFO: JBoss Remoting version 3.3.7.Final-redhat-1 Exception in thread "main" java.lang.ClassCastException: [Ljava.lang.Object; cannot be cast to [Ljava.lang.String; at org.jboss.remotingjmx.RemotingConnector.internalRemotingConnect(RemotingConnector.java:210) at org.jboss.remotingjmx.RemotingConnector.internalConnect(RemotingConnector.java:151) at org.jboss.remotingjmx.RemotingConnector.connect(RemotingConnector.java:102) at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270) at com.redhat.cee.prodsec.jmx.JMXExample.main(JMXExample.java:27) Marked EAP 6 and layered products as not affected. This issue did not affect tomcat packages as shipped in Red Hat Enterprise Linux 6 and 7, as the affected JmxRemoteLifecycleListener is not included in binary packages distributed by Red Hat. The vulnerable source code is included in source packages, but is not included in the binary packages included in the distribution. This issue has been addressed in the following products: Red Hat JBoss Web Server 3.1.0 Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456 This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 6 Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455 |