Bug 1701056 (CVE-2019-0232) - CVE-2019-0232 tomcat: Remote Code Execution on Windows
Summary: CVE-2019-0232 tomcat: Remote Code Execution on Windows
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-0232
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1700240
TreeView+ depends on / blocked
 
Reported: 2019-04-17 21:47 UTC by Laura Pardo
Modified: 2020-03-23 14:57 UTC (History)
78 users (show)

Fixed In Version: tomcat 7.0.94, tomcat 8.5.40, tomcat 9.0.19
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.
Clone Of:
Environment:
Last Closed: 2019-07-12 13:07:01 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1712 None None None 2019-07-09 13:56:25 UTC

Description Laura Pardo 2019-04-17 21:47:48 UTC
A vulnerability was found in in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93. When running on Windows with enableCmdLineArguments enabled, the CGI Servlet is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability).


References:
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html


Upstream Patch:
https://github.com/apache/tomcat/commit/7f0221b

Comment 3 Doran Moppert 2019-04-18 05:23:59 UTC
Statement:

This vulnerability is specific to the Windows platform's treatment of file names and how they must be quoted.  Tomcat running on Linux hosts is not affected.

Comment 4 errata-xmlrpc 2019-07-09 13:56:22 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2019:1712 https://access.redhat.com/errata/RHSA-2019:1712

Comment 5 Product Security DevOps Team 2019-07-12 13:07:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-0232


Note You need to log in before you can comment on or make changes to this bug.