CVE-2016-6325
First published: Tue Aug 16 2016(Updated: )
It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/tomcat6 | <0:6.0.24-98.el6_8 | 0:6.0.24-98.el6_8 |
| redhat/tomcat | <0:7.0.54-8.el7_2 | 0:7.0.54-8.el7_2 |
| redhat/hibernate4-eap6 | <0:4.2.23-1.Final_redhat_1.1.ep6.el6 | 0:4.2.23-1.Final_redhat_1.1.ep6.el6 |
| redhat/jbcs-httpd24 | <0:1-3.jbcs.el6 | 0:1-3.jbcs.el6 |
| redhat/jbcs-httpd24-apache-commons-daemon | <0:1.0.15-1.redhat_2.1.jbcs.el6 | 0:1.0.15-1.redhat_2.1.jbcs.el6 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc | <1:1.0.15-17.redhat_2.jbcs.el6 | 1:1.0.15-17.redhat_2.jbcs.el6 |
| redhat/tomcat7 | <0:7.0.70-16.ep7.el6 | 0:7.0.70-16.ep7.el6 |
| redhat/tomcat8 | <0:8.0.36-17.ep7.el6 | 0:8.0.36-17.ep7.el6 |
| redhat/tomcat-native | <0:1.2.8-9.redhat_9.ep7.el6 | 0:1.2.8-9.redhat_9.ep7.el6 |
| redhat/tomcat-vault | <0:1.0.8-9.Final_redhat_2.1.ep7.el6 | 0:1.0.8-9.Final_redhat_2.1.ep7.el6 |
| redhat/hibernate4-eap6 | <0:4.2.23-1.Final_redhat_1.1.ep6.el7 | 0:4.2.23-1.Final_redhat_1.1.ep6.el7 |
| redhat/jbcs-httpd24 | <0:1-3.jbcs.el7 | 0:1-3.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon | <0:1.0.15-1.redhat_2.1.jbcs.el7 | 0:1.0.15-1.redhat_2.1.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc | <1:1.0.15-17.redhat_2.jbcs.el7 | 1:1.0.15-17.redhat_2.jbcs.el7 |
| redhat/tomcat7 | <0:7.0.70-16.ep7.el7 | 0:7.0.70-16.ep7.el7 |
| redhat/tomcat8 | <0:8.0.36-17.ep7.el7 | 0:8.0.36-17.ep7.el7 |
| redhat/tomcat-native | <0:1.2.8-9.redhat_9.ep7.el7 | 0:1.2.8-9.redhat_9.ep7.el7 |
| redhat/tomcat-vault | <0:1.0.8-9.Final_redhat_2.1.ep7.el7 | 0:1.0.8-9.Final_redhat_2.1.ep7.el7 |
| Apache Tomcat | ||
| Redhat Jboss Enterprise Web Server | =2.0.0 | |
| Redhat Jboss Web Server | =3.0 | |
| Redhat Enterprise Linux | =5.0 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Hpc Node | =6.0 | |
| Redhat Enterprise Linux Hpc Node | =7.0 | |
| Redhat Enterprise Linux Hpc Node Eus | =7.2 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Server Aus | =7.2 | |
| Redhat Enterprise Linux Server Eus | =7.2 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Redhat Enterprise Linux Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2016-6325 https://nvd.nist.gov/vuln/detail/CVE-2016-6325
- https://bugzilla.redhat.com/show_bug.cgi?id=1367447
- https://access.redhat.com/errata/RHSA-2016:2045
- https://access.redhat.com/errata/RHSA-2016:2046
- https://access.redhat.com/errata/RHSA-2017:0457
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- https://access.redhat.com/security/cve/CVE-2016-6325
- https://access.redhat.com/security/cve/CVE-2016-5425
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1362545#c10
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1383216
- https://rhn.redhat.com/errata/RHSA-2016-2046.html
- https://rhn.redhat.com/errata/RHSA-2016-2045.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1420125
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1420223
- https://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://rhn.redhat.com/errata/RHSA-2016-2045.html
- http://rhn.redhat.com/errata/RHSA-2016-2046.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- http://www.securityfocus.com/bid/93478
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-6325
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- package-manager/redhat
- vendor/apache
- canonical/apache tomcat
- vendor/redhat
- canonical/redhat jboss enterprise web server
- version/redhat jboss enterprise web server/2.0.0
- canonical/redhat jboss web server
- version/redhat jboss web server/3.0
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5.0
- version/redhat enterprise linux/6.0
- version/redhat enterprise linux/7.0
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux hpc node
- version/redhat enterprise linux hpc node/6.0
- version/redhat enterprise linux hpc node/7.0
- canonical/redhat enterprise linux hpc node eus
- version/redhat enterprise linux hpc node eus/7.2
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/7.2
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/7.2
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0