CVE-2016-6794: Medium severity Apache Tomcat vulnerability
The following flaw was found in Tomcat:
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
Upstream patches:
6.0.47: https://svn.apache.org/viewvc?view=revision&revision=1754733 7.0.72: https://svn.apache.org/viewvc?view=revision&revision=1754728 8.5.5: https://svn.apache.org/viewvc?view=revision&revision=1754726 8.0.37: https://svn.apache.org/viewvc?view=revision&revision=1754727
External References:
https://tomcat.apache.org/security-6.html#FixedinApacheTomcat6.0.47 https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.72 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.5and8.0.37
Other sources
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 9.0.0.M10 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.5.5 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.0.37 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 7.0.72 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 6.0.47 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 6.0.47 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.72 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.5 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.37 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 6.0.47 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 7.0.72 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.0.37 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.5.5
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6794?
CVE-2016-6794 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-6794?
To fix CVE-2016-6794, update Tomcat to version 6.0.47 or later, 7.0.72 or later, 8.0.37 or later, or 8.5.5 or later.
What systems are affected by CVE-2016-6794?
CVE-2016-6794 affects Apache Tomcat versions prior to 6.0.47, 7.0.72, 8.0.37, and 8.5.5, as well as earlier milestone versions of Tomcat 9.0.
What does CVE-2016-6794 exploit?
CVE-2016-6794 exploits the improper control of a web application’s ability to read system properties when a SecurityManager is configured.
Is there a workaround for CVE-2016-6794?
While updating to the fixed versions is recommended, temporarily disabling the system property replacement feature in Tomcat can mitigate some risks associated with CVE-2016-6794.