Date: Mon, 10 Oct 2016 04:32:57 -0300 From: Dawid Golunski <dawid@...alhackers.com> To: oss-security@...ts.openwall.com Subject: CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.) Vulnerability: Apache Tomcat packaging on RedHat-based distros CVE-2016-5425 Discovered by: Dawid Golunski (http://legalhackers.com) Affected systems: Multiple Tomcat packages on RedHat-based systems including: CentOS,Fedora,OracleLinux,RedHat etc. Short Description: Apache Tomcat packages provided by default repositories of RedHat-based distributions (including CentOS, RedHat, OracleLinux, Fedora, etc.) create a tmpfiles.d configuration file with insecure permissions which allow attackers who are able to write files with tomcat user permissions (for example, through a vulnerability in web application hosted on Tomcat) to escalate their privileges from tomcat user to root and fully compromise the target system. Full advisory and a working root privilege escalation exploit can be found at: http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html BTW. If you are using Tomcat on a Debian-based distro, you may want to check out my previous Tomcat advisory and exploit at: http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html -- Regards, Dawid Golunski http://legalhackers.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.