CVE-2013-1976
First published: Tue Mar 26 2013(Updated: )
A security flaw was found in the way init script implementation of the Tomcat service, an Apache Servlet/JSP Engine, as used in various versions of Red Hat Enterprise Linux and Fedora, performed management of Tomcat log file. A local attacker could use this flaw to cause denial of service or, potentially, execute arbitrary code with the privileges of the privileged system user (root) via symbolic link attacks on Tomcat log file. Acknowledgements: Red Hat would like to thank Simon Fayer of Imperial College London for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat JBoss Enterprise Web Server | =1.0.2 | |
| Red Hat JBoss Enterprise Web Server | =2.0.0 | |
| Red Hat Enterprise Linux | =5 | |
| Red Hat Enterprise Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00013.html
- http://rhn.redhat.com/errata/RHSA-2013-0869.html
- http://rhn.redhat.com/errata/RHSA-2013-0870.html
- http://rhn.redhat.com/errata/RHSA-2013-0871.html
- http://rhn.redhat.com/errata/RHSA-2013-0872.html
- https://bugzilla.redhat.com/show_bug.cgi?id=927622
- https://rhn.redhat.com/errata/RHSA-2013-0869.html
- https://rhn.redhat.com/errata/RHSA-2013-0872.html
- https://rhn.redhat.com/errata/RHSA-2013-0871.html
- https://rhn.redhat.com/errata/RHSA-2013-0870.html
Frequently Asked Questions
What is the severity of CVE-2013-1976?
CVE-2013-1976 is classified as a medium severity vulnerability.
How do I fix CVE-2013-1976?
To fix CVE-2013-1976, update Red Hat JBoss Enterprise Web Server and Red Hat Enterprise Linux to versions that include the security patches.
What systems are affected by CVE-2013-1976?
CVE-2013-1976 affects Red Hat JBoss Enterprise Web Server versions 1.0.2 and 2.0.0, as well as Red Hat Enterprise Linux versions 5 and 6.0.
What type of attack can exploit CVE-2013-1976?
CVE-2013-1976 can be exploited by a local attacker to cause denial of service.
When was CVE-2013-1976 disclosed?
CVE-2013-1976 was disclosed in August 2013.
- agent/type
- agent/first-publish-date
- agent/references
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-1976
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat jboss enterprise web server
- version/red hat jboss enterprise web server/1.0.2
- version/red hat jboss enterprise web server/2.0.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/5
- version/red hat enterprise linux/6.0