The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used. Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6 Upstream patches: Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684 Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676 Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656 Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646 External References: https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1397493] Affects: epel-6 [bug 1397495]
Although Fuse-6 is marked as not affected by this issue. We created a new CVE for that product because it does not use JMXRemoteLifecycleListner, and this issue has 'tomcat' in the title. It's been assigned CVE-2016-8653.
EAP 6 is not affected by this issue. Here is the stacktrace which I get when trying the exploit there: INFO: JBoss Remoting version 3.3.7.Final-redhat-1 Exception in thread "main" java.lang.ClassCastException: [Ljava.lang.Object; cannot be cast to [Ljava.lang.String; at org.jboss.remotingjmx.RemotingConnector.internalRemotingConnect(RemotingConnector.java:210) at org.jboss.remotingjmx.RemotingConnector.internalConnect(RemotingConnector.java:151) at org.jboss.remotingjmx.RemotingConnector.connect(RemotingConnector.java:102) at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270) at com.redhat.cee.prodsec.jmx.JMXExample.main(JMXExample.java:27) Marked EAP 6 and layered products as not affected.
This issue did not affect tomcat packages as shipped in Red Hat Enterprise Linux 6 and 7, as the affected JmxRemoteLifecycleListener is not included in binary packages distributed by Red Hat. The vulnerable source code is included in source packages, but is not included in the binary packages included in the distribution.
This issue has been addressed in the following products: Red Hat JBoss Web Server 3.1.0 Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html
This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456
This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 6 Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455