Bug 1397485 (CVE-2016-8735) - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
Summary: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecyc...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-8735
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1397493 1397495 Red Hat1397496 Red Hat1398263 Red Hat1398264 Red Hat1399020 Red Hat1399021 Engineering1402657 Engineering1402658 Engineering1402659 Engineering1402660
Blocks: Embargoed1397488 Embargoed1397645 Embargoed1428325 Embargoed1482229
TreeView+ depends on / blocked
 
Reported: 2016-11-22 15:56 UTC by Adam Mariš
Modified: 2023-05-15 14:58 UTC (History)
67 users (show)

Fixed In Version: tomcat 6.0.48, tomcat 7.0.73, tomcat 8.0.39, tomcat 8.5.8
Doc Type: If docs needed, set a value
Doc Text:
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance.
Clone Of:
Environment:
Last Closed: 2021-10-27 10:53:45 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0455 0 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update 2017-03-08 00:06:40 UTC
Red Hat Product Errata RHSA-2017:0456 0 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update 2017-03-08 00:06:06 UTC
Red Hat Product Errata RHSA-2017:0457 0 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server security and enhancement update 2017-03-08 00:05:59 UTC

Description Adam Mariš 2016-11-22 15:56:47 UTC 
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.

Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6

Upstream patches:

Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646

External References:

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
Comment 2 Adam Mariš 2016-11-22 16:09:08 UTC 
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1397493]
Affects: epel-6 [bug 1397495]
Comment 6 Jason Shepherd 2016-11-30 22:25:51 UTC 
Although Fuse-6 is marked as not affected by this issue. We created a new CVE for that product because it does not use JMXRemoteLifecycleListner, and this issue has 'tomcat' in the title. It's been assigned CVE-2016-8653.
Comment 7 Jason Shepherd 2016-11-30 22:26:46 UTC 
EAP 6 is not affected by this issue. Here is the stacktrace which I get when trying the exploit there:

INFO: JBoss Remoting version 3.3.7.Final-redhat-1
Exception in thread "main" java.lang.ClassCastException: [Ljava.lang.Object; cannot be cast to [Ljava.lang.String;
	at org.jboss.remotingjmx.RemotingConnector.internalRemotingConnect(RemotingConnector.java:210)
	at org.jboss.remotingjmx.RemotingConnector.internalConnect(RemotingConnector.java:151)
	at org.jboss.remotingjmx.RemotingConnector.connect(RemotingConnector.java:102)
	at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270)
	at com.redhat.cee.prodsec.jmx.JMXExample.main(JMXExample.java:27)

Marked EAP 6 and layered products as not affected.
Comment 11 Tomas Hoger 2017-01-11 21:31:10 UTC 
This issue did not affect tomcat packages as shipped in Red Hat Enterprise Linux 6 and 7, as the affected JmxRemoteLifecycleListener is not included in binary packages distributed by Red Hat.  The vulnerable source code is included in source packages, but is not included in the binary packages included in the distribution.
Comment 13 errata-xmlrpc 2017-03-07 19:10:51 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3.1.0

Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html
Comment 14 errata-xmlrpc 2017-03-07 19:15:23 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 7

Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456
Comment 15 errata-xmlrpc 2017-03-07 19:19:53 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 6

Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455
Note You need to log in before you can comment on or make changes to this bug.