Bug 1397485 (CVE-2016-8735)

Summary: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aileenc, alee, apmukher, aszczucz, bbaranow, bdawidow, bihu, bmaxwell, ccoleman, cdewolf, chazlett, coolsvap, csutherl, dandread, darran.lofthouse, dedgar, dmcphers, dosoudil, epp-bugs, fnasser, gzaronik, hhorak, huwang, ivan.afonichev, jason.greene, java-sig-commits, jawilson, jboss-set, jclere, jcoleman, jdg-bugs, jdoyle, jgoulding, jialiu, joelsmith, jokerman, jolee, jorton, jpallich, jshepherd, kanderso, krzysztof.daniel, lgao, lmeyer, mbabacek, mbaluch, mizdebsk, mmccomas, mmiura, mnewsome, mweiler, myarboro, nobody+bgollahe, nwallace, ohudlick, pslavice, rfreire, rnetuka, rsvoboda, rzima, theute, ttarrant, twalsh, vondruch, vtunka, weli, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tomcat 6.0.48, tomcat 7.0.73, tomcat 8.0.39, tomcat 8.5.8 Doc Type: If docs needed, set a value
Doc Text:
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-27 10:53:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1397493, 1397495, 1397496, 1398263, 1398264, 1399020, 1399021, 1402657, 1402658, 1402659, 1402660    
Bug Blocks: 1397488, 1397645, 1428325, 1482229    

Description Adam Mariš 2016-11-22 15:56:47 UTC
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.

Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6

Upstream patches:

Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646

External References:

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

Comment 2 Adam Mariš 2016-11-22 16:09:08 UTC
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1397493]
Affects: epel-6 [bug 1397495]

Comment 6 Jason Shepherd 2016-11-30 22:25:51 UTC
Although Fuse-6 is marked as not affected by this issue. We created a new CVE for that product because it does not use JMXRemoteLifecycleListner, and this issue has 'tomcat' in the title. It's been assigned CVE-2016-8653.

Comment 7 Jason Shepherd 2016-11-30 22:26:46 UTC
EAP 6 is not affected by this issue. Here is the stacktrace which I get when trying the exploit there:

INFO: JBoss Remoting version 3.3.7.Final-redhat-1
Exception in thread "main" java.lang.ClassCastException: [Ljava.lang.Object; cannot be cast to [Ljava.lang.String;
	at org.jboss.remotingjmx.RemotingConnector.internalRemotingConnect(RemotingConnector.java:210)
	at org.jboss.remotingjmx.RemotingConnector.internalConnect(RemotingConnector.java:151)
	at org.jboss.remotingjmx.RemotingConnector.connect(RemotingConnector.java:102)
	at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270)
	at com.redhat.cee.prodsec.jmx.JMXExample.main(JMXExample.java:27)

Marked EAP 6 and layered products as not affected.

Comment 11 Tomas Hoger 2017-01-11 21:31:10 UTC
This issue did not affect tomcat packages as shipped in Red Hat Enterprise Linux 6 and 7, as the affected JmxRemoteLifecycleListener is not included in binary packages distributed by Red Hat.  The vulnerable source code is included in source packages, but is not included in the binary packages included in the distribution.

Comment 13 errata-xmlrpc 2017-03-07 19:10:51 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3.1.0

Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html

Comment 14 errata-xmlrpc 2017-03-07 19:15:23 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 7

Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456

Comment 15 errata-xmlrpc 2017-03-07 19:19:53 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 6

Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455