CVE-2016-5425

Опубликовано: 13 окт. 2016

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Средний

Описание

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Ссылки

http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html
Exploit
Third Party Advisory
VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2046.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/10/2
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Third Party Advisory
http://www.securityfocus.com/bid/93472
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036979
Third Party Advisory
VDB Entry
https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
https://www.exploit-db.com/exploits/40488/
Third Party Advisory
VDB Entry
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Third Party Advisory
http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html
Exploit
Third Party Advisory
VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2046.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/10/2
Mailing List
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Third Party Advisory
http://www.securityfocus.com/bid/93472
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036979
Third Party Advisory
VDB Entry
https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
https://www.exploit-db.com/exploits/40488/
Third Party Advisory
VDB Entry
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:apache:tomcat:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.14472

Средний

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-276

Связанные уязвимости

CVE-2016-5425

CVSS3: 7.8

ubuntu

больше 8 лет назад

CVE-2016-5425

CVSS3: 7

redhat

больше 8 лет назад

CVE-2016-5425

CVSS3: 7.8

debian

больше 8 лет назад

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentO ...

GHSA-c7fc-mp9g-99j3

CVSS3: 7.8

github

около 3 лет назад

ELSA-2016-2046

oracle-oval

больше 8 лет назад

ELSA-2016-2046: tomcat security update (IMPORTANT)

EPSS

Процентиль: 94%

0.14472

Средний

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-276