REDHAT-BUG-1362545: High severity tomcat vulnerability
It was reported that Tomcat packages in Red Hat Enterprise Linux 7 are vulnerable to local privilege escalation from tomcat group user to root. Tomcat configuration file located at /usr/lib/tmpfiles.d/tomcat.conf can be modified by any user belonging to tomcat group. This file is used by /usr/bin/systemd-tmpfiles service to create temporary files.
As the systemd-tmpfiles service runs with root permissions, this enables the tomcat user to gain root privileges by editing the /usr/lib/tmpfiles.d/tomcat.conf file to contain a line which will cause the systemd-tmpfiles to create files within arbitrary system directory and arbitrary permissions.
External Reference:
http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1362545?
The severity of REDHAT-BUG-1362545 is classified as high with a score of 7.
How do I fix REDHAT-BUG-1362545?
To fix REDHAT-BUG-1362545, you should update the Tomcat packages to the latest version provided by Red Hat.
What vulnerability does REDHAT-BUG-1362545 address?
REDHAT-BUG-1362545 addresses a local privilege escalation vulnerability from the tomcat group user to root.
Which software is affected by REDHAT-BUG-1362545?
The software affected by REDHAT-BUG-1362545 is Red Hat Tomcat on Red Hat Enterprise Linux 7.
What files are involved in the vulnerability REDHAT-BUG-1362545?
The vulnerability involves the Tomcat configuration file located at /usr/lib/tmpfiles.d/tomcat.conf.