CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Other sources
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
— GitHub
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684 Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676 Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656 Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646
External References:
https://tomcat.apache.org/security-6.html#FixedinApacheTomcat6.0.48 https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.73 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.39 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.8
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalina-jmx-remoteto a version that resolves this vulnerability.Fixed in 9.0.0.M12 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalina-jmx-remoteto a version that resolves this vulnerability.Fixed in 8.5.7 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalina-jmx-remoteto a version that resolves this vulnerability.Fixed in 8.0.39 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalina-jmx-remoteto a version that resolves this vulnerability.Fixed in 7.0.73 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalina-jmx-remoteto a version that resolves this vulnerability.Fixed in 6.0.48 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 9.0.0.M12 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 8.5.7 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 8.0.39 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 7.0.73 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 6.0.48 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.43-2~deb11u10Fixed in 9.0.118-0+deb11u1Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.118-1 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 6.0.48 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.73 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.39 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.8 - Upgrade
Upgrade
Apache Tomcat 6.0to a version that resolves this vulnerability.Fixed in 6.0.48 - Upgrade
Upgrade
Apache Tomcat 7.0to a version that resolves this vulnerability.Fixed in 7.0.73 - Upgrade
Upgrade
Apache Tomcat 8.0to a version that resolves this vulnerability.Fixed in 8.0.39 - Upgrade
Upgrade
Apache Tomcat 8.5to a version that resolves this vulnerability.Fixed in 8.5.8 - Compensating control
If using the JmxRemoteLifecycleListener, ensure Java Management Extension (JMX) ports are not reachable by an attacker (restrict network access to JMX ports).
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8735?
CVE-2016-8735 has been rated as critical due to its potential for remote code execution.
How do I fix CVE-2016-8735?
To mitigate CVE-2016-8735, upgrade Apache Tomcat to version 6.0.48 or later, or apply necessary security patches.
What versions of Apache Tomcat are affected by CVE-2016-8735?
CVE-2016-8735 affects Apache Tomcat versions from 6.0.0 to 6.0.47, as well as multiple versions of 7.x, 8.x, and 9.x.
What is the attack vector for CVE-2016-8735?
The attack vector for CVE-2016-8735 involves an attacker gaining access to JMX ports exposed by the JmxRemoteLifecycleListener.
What kind of vulnerabilities are associated with CVE-2016-8735?
CVE-2016-8735 is associated with remote code execution vulnerabilities related to improper handling of management extensions in Apache Tomcat.