oss-sec mailing list archives
CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.)
From: Dawid Golunski <dawid () legalhackers com>
Date: Mon, 10 Oct 2016 04:32:57 -0300
Vulnerability: Apache Tomcat packaging on RedHat-based distros CVE-2016-5425 Discovered by: Dawid Golunski (http://legalhackers.com) Affected systems: Multiple Tomcat packages on RedHat-based systems including: CentOS,Fedora,OracleLinux,RedHat etc. Short Description: Apache Tomcat packages provided by default repositories of RedHat-based distributions (including CentOS, RedHat, OracleLinux, Fedora, etc.) create a tmpfiles.d configuration file with insecure permissions which allow attackers who are able to write files with tomcat user permissions (for example, through a vulnerability in web application hosted on Tomcat) to escalate their privileges from tomcat user to root and fully compromise the target system. Full advisory and a working root privilege escalation exploit can be found at: http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html BTW. If you are using Tomcat on a Debian-based distro, you may want to check out my previous Tomcat advisory and exploit at: http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html -- Regards, Dawid Golunski http://legalhackers.com
Current thread:
- CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.) Dawid Golunski (Oct 10)