CVE-2016-6816: Input Validation

Q: What is the severity of CVE-2016-6816?

CVE-2016-6816 has a severity rating of 'Moderate' according to the Common Vulnerability Scoring System.

Q: How do I fix CVE-2016-6816?

To resolve CVE-2016-6816, upgrade to the affected software versions specified in the remediation notes for your specific platform.

Q: What applications are affected by CVE-2016-6816?

Applications such as Apache Tomcat versions prior to 6.0.48 and 7.0.73, as well as certain Red Hat software packages, are affected by CVE-2016-6816.

Q: Can CVE-2016-6816 lead to data leakage?

Yes, exploiting CVE-2016-6816 could potentially allow an attacker to inject data into the HTTP response, leading to data leakage.

Q: Is CVE-2016-6816 a remote attack vector?

Yes, CVE-2016-6816 can be exploited remotely through crafted HTTP requests.

Published Nov 22, 2016

Updated

It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own.

Other sources

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

The code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6

Upstream patches:

Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767683 Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767675 Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767653 Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767645

External References:

https://tomcat.apache.org/security-6.html#FixedinApacheTomcat6.0.48 https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.73 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.39 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.8 https://access.redhat.com/solutions/2891171 https://access.redhat.com/articles/2991951

— Red Hat

Affected Software

431 affected componentsFixes available

redhat/tomcat6<0:6.0.24-105.el6_8

0:6.0.24-105.el6_8

redhat/tomcat<0:7.0.69-11.el7_3

0:7.0.69-11.el7_3

redhat/apache-cxf<0:2.7.18-5.SP4_redhat_1.1.ep6.el5

0:2.7.18-5.SP4_redhat_1.1.ep6.el5

redhat/hornetq<0:2.3.25-18.SP16_redhat_1.1.ep6.el5

0:2.3.25-18.SP16_redhat_1.1.ep6.el5

redhat/infinispan<0:5.2.20-1.Final_redhat_1.1.ep6.el5

0:5.2.20-1.Final_redhat_1.1.ep6.el5

redhat/jboss-as-appclient<0:7.5.13-2.Final_redhat_2.1.ep6.el5