Bug 1397485 (CVE-2016-8735) - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
Summary: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecyc...
Keywords:
Status: NEW
Alias: CVE-2016-8735
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20161122,repo...
Depends On: 1397493 1397495 1397496 1398263 1398264 1399020 1399021 1402657 1402658 1402659 1402660
Blocks: 1397488 1397645 1428325 1482229
TreeView+ depends on / blocked
 
Reported: 2016-11-22 15:56 UTC by Adam Mariš
Modified: 2019-07-04 10:52 UTC (History)
71 users (show)

Fixed In Version: tomcat 6.0.48, tomcat 7.0.73, tomcat 8.0.39, tomcat 8.5.8
Doc Type: If docs needed, set a value
Doc Text:
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0455 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update 2017-03-08 00:06:40 UTC
Red Hat Product Errata RHSA-2017:0456 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update 2017-03-08 00:06:06 UTC
Red Hat Product Errata RHSA-2017:0457 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server security and enhancement update 2017-03-08 00:05:59 UTC

Description Adam Mariš 2016-11-22 15:56:47 UTC
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.

Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6

Upstream patches:

Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646

External References:

https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

Comment 2 Adam Mariš 2016-11-22 16:09:08 UTC
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1397493]
Affects: epel-6 [bug 1397495]

Comment 6 Jason Shepherd 2016-11-30 22:25:51 UTC
Although Fuse-6 is marked as not affected by this issue. We created a new CVE for that product because it does not use JMXRemoteLifecycleListner, and this issue has 'tomcat' in the title. It's been assigned CVE-2016-8653.

Comment 7 Jason Shepherd 2016-11-30 22:26:46 UTC
EAP 6 is not affected by this issue. Here is the stacktrace which I get when trying the exploit there:

INFO: JBoss Remoting version 3.3.7.Final-redhat-1
Exception in thread "main" java.lang.ClassCastException: [Ljava.lang.Object; cannot be cast to [Ljava.lang.String;
	at org.jboss.remotingjmx.RemotingConnector.internalRemotingConnect(RemotingConnector.java:210)
	at org.jboss.remotingjmx.RemotingConnector.internalConnect(RemotingConnector.java:151)
	at org.jboss.remotingjmx.RemotingConnector.connect(RemotingConnector.java:102)
	at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270)
	at com.redhat.cee.prodsec.jmx.JMXExample.main(JMXExample.java:27)

Marked EAP 6 and layered products as not affected.

Comment 11 Tomas Hoger 2017-01-11 21:31:10 UTC
This issue did not affect tomcat packages as shipped in Red Hat Enterprise Linux 6 and 7, as the affected JmxRemoteLifecycleListener is not included in binary packages distributed by Red Hat.  The vulnerable source code is included in source packages, but is not included in the binary packages included in the distribution.

Comment 13 errata-xmlrpc 2017-03-07 19:10:51 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3.1.0

Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html

Comment 14 errata-xmlrpc 2017-03-07 19:15:23 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 7

Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456

Comment 15 errata-xmlrpc 2017-03-07 19:19:53 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 6

Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455


Note You need to log in before you can comment on or make changes to this bug.