CVE-2016-0706
Publication date 24 February 2016
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
From the Ubuntu Security Team
It was discovered that Tomcat did not place StatusManagerServlet on the RestrictedServlets list. A remote attacker could possibly use this issue to read arbitrary HTTP requests, including session ID values. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10.
Status
Package | Ubuntu Release | Status |
---|---|---|
tomcat6 | 18.04 LTS bionic | Not in release |
16.04 LTS xenial |
Fixed 6.0.45+dfsg-1
|
|
14.04 LTS trusty |
Fixed 6.0.39-1ubuntu0.1
|
|
tomcat7 | 18.04 LTS bionic |
Not affected
|
16.04 LTS xenial |
Not affected
|
|
14.04 LTS trusty |
Fixed 7.0.52-1ubuntu0.6
|
|
tomcat8 | 18.04 LTS bionic |
Not affected
|
16.04 LTS xenial |
Not affected
|
|
14.04 LTS trusty | Not in release | |
Patch details
Package | Patch details |
---|---|
tomcat6 | |
tomcat7 | |
tomcat8 |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 4.3 · Medium |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | Low |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-3024-1
- Tomcat vulnerabilities
- 5 July 2016