CVE-2016-1240: Input Validation

Q: What is the severity of CVE-2016-1240?

CVE-2016-1240 is classified with high severity due to the potential for root privilege escalation.

Q: How do I fix CVE-2016-1240?

To fix CVE-2016-1240, update the affected Tomcat packages to the latest versions provided by your distribution.

Q: Which versions of Tomcat are affected by CVE-2016-1240?

CVE-2016-1240 affects Tomcat versions before 6.0.35, 7.0.56, and 8.0.14.

Q: What platforms are impacted by CVE-2016-1240?

CVE-2016-1240 impacts Debian Jessie and Ubuntu 12.04 LTS, among others.

Q: Is CVE-2016-1240 an exploit in Tomcat's init script?

Yes, CVE-2016-1240 is a vulnerability in the Tomcat init script that allows for privilege escalation.

Published Sep 15, 2016

Updated

It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation.

Other sources

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

Affected Software

24 affected componentsFixes available

debian/tomcat6

redhat/hibernate4-eap6<0:4.2.23-1.Final_redhat_1.1.ep6.el6

0:4.2.23-1.Final_redhat_1.1.ep6.el6

redhat/jbcs-httpd24<0:1-3.jbcs.el6

0:1-3.jbcs.el6

redhat/jbcs-httpd24-apache-commons-daemon<0:1.0.15-1.redhat_2.1.jbcs.el6

0:1.0.15-1.redhat_2.1.jbcs.el6

redhat/jbcs-httpd24-apache-commons-daemon-jsvc<1:1.0.15-17.redhat_2.jbcs.el6

1:1.0.15-17.redhat_2.jbcs.el6

redhat/tomcat7<0:7.0.70-16.ep7.el6

0:7.0.70-16.ep7.el6

redhat/tomcat8<0:8.0.36-17.ep7.el6

0:8.0.36-17.ep7.el6

redhat/tomcat-native<0:1.2.8-9.redhat_9.ep7.el6

0:1.2.8-9.redhat_9.ep7.el6

redhat/tomcat-vault<0:1.0.8-9.Final_redhat_2.1.ep7.el6

0:1.0.8-9.Final_redhat_2.1.ep7.el6

redhat/hibernate4-eap6<0:4.2.23-1.Final_redhat_1.1.ep6.el7

0:4.2.23-1.Final_redhat_1.1.ep6.el7

redhat/jbcs-httpd24<0:1-3.jbcs.el7

0:1-3.jbcs.el7

redhat/jbcs-httpd24-apache-commons-daemon<0:1.0.15-1.redhat_2.1.jbcs.el7

0:1.0.15-1.redhat_2.1.jbcs.el7

redhat/jbcs-httpd24-apache-commons-daemon-jsvc<1:1.0.15-17.redhat_2.jbcs.el7

1:1.0.15-17.redhat_2.jbcs.el7

redhat/tomcat7<0:7.0.70-16.ep7.el7

0:7.0.70-16.ep7.el7

redhat/tomcat8<0:8.0.36-17.ep7.el7

0:8.0.36-17.ep7.el7

redhat/tomcat-native<0:1.2.8-9.redhat_9.ep7.el7

0:1.2.8-9.redhat_9.ep7.el7

redhat/tomcat-vault<0:1.0.8-9.Final_redhat_2.1.ep7.el7

0:1.0.8-9.Final_redhat_2.1.ep7.el7

Apache Tomcat=6.0

Apache Tomcat=7.0

Apache Tomcat=8.0

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

Debian Debian Linux=8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/hibernate4-eap6 to a version that resolves this vulnerability.
Fixed in 0:4.2.23-1.Final_redhat_1.1.ep6.el6
Upgrade
Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.
Fixed in 0:1-3.jbcs.el6
Upgrade
Upgrade redhat/jbcs-httpd24-apache-commons-daemon to a version that resolves this vulnerability.
Fixed in 0:1.0.15-1.redhat_2.1.jbcs.el6
Upgrade
Upgrade redhat/jbcs-httpd24-apache-commons-daemon-jsvc to a version that resolves this vulnerability.
Fixed in 1:1.0.15-17.redhat_2.jbcs.el6
Upgrade
Upgrade redhat/tomcat7 to a version that resolves this vulnerability.
Fixed in 0:7.0.70-16.ep7.el6
Upgrade
Upgrade redhat/tomcat8 to a version that resolves this vulnerability.
Fixed in 0:8.0.36-17.ep7.el6
Upgrade
Upgrade redhat/tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.8-9.redhat_9.ep7.el6
Upgrade
Upgrade redhat/tomcat-vault to a version that resolves this vulnerability.
Fixed in 0:1.0.8-9.Final_redhat_2.1.ep7.el6
Upgrade
Upgrade redhat/hibernate4-eap6 to a version that resolves this vulnerability.
Fixed in 0:4.2.23-1.Final_redhat_1.1.ep6.el7
Upgrade
Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.
Fixed in 0:1-3.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-apache-commons-daemon to a version that resolves this vulnerability.
Fixed in 0:1.0.15-1.redhat_2.1.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-apache-commons-daemon-jsvc to a version that resolves this vulnerability.
Fixed in 1:1.0.15-17.redhat_2.jbcs.el7
Upgrade
Upgrade redhat/tomcat7 to a version that resolves this vulnerability.
Fixed in 0:7.0.70-16.ep7.el7
Upgrade
Upgrade redhat/tomcat8 to a version that resolves this vulnerability.
Fixed in 0:8.0.36-17.ep7.el7
Upgrade
Upgrade redhat/tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.8-9.redhat_9.ep7.el7
Upgrade
Upgrade redhat/tomcat-vault to a version that resolves this vulnerability.
Fixed in 0:1.0.8-9.Final_redhat_2.1.ep7.el7

Event History

Sep 15, 2016

CVE Published

12:00 AM

Sep 16, 2016

Data Sourced

via Red Hat·08:38 AM

DescriptionSeverityAffected Software

Oct 3, 2016

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2016-1240?