Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 10 Oct 2016 04:32:57 -0300
From: Dawid Golunski <dawid@...alhackers.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros -
 Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.)

Vulnerability: Apache Tomcat packaging on RedHat-based distros

CVE-2016-5425

Discovered by:
Dawid Golunski (http://legalhackers.com)

Affected systems: Multiple Tomcat packages on RedHat-based systems
including: CentOS,Fedora,OracleLinux,RedHat etc.

Short Description:

Apache Tomcat packages provided by default repositories of RedHat-based
distributions (including CentOS, RedHat, OracleLinux, Fedora,  etc.)
create a tmpfiles.d configuration file with insecure permissions which
allow attackers who are able to write files with tomcat user permissions
(for example, through a vulnerability in web application hosted on Tomcat)
to escalate their privileges from tomcat user to root and fully compromise
the target system.

Full advisory and a working root privilege escalation exploit can be found
at:

http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html


BTW. If you are using Tomcat on a Debian-based distro,  you may want
to check out
my previous Tomcat advisory and exploit at:

http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html


-- 
Regards,
Dawid Golunski
http://legalhackers.com

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ