[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CADSYzssdZ5k5H92mOKaLHE38Db0har=n4azHZeNosC-wsr55dw@mail.gmail.com>
Date: Mon, 10 Oct 2016 04:32:57 -0300
From: Dawid Golunski <dawid@...alhackers.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros -
Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.)
Vulnerability: Apache Tomcat packaging on RedHat-based distros
CVE-2016-5425
Discovered by:
Dawid Golunski (http://legalhackers.com)
Affected systems: Multiple Tomcat packages on RedHat-based systems
including: CentOS,Fedora,OracleLinux,RedHat etc.
Short Description:
Apache Tomcat packages provided by default repositories of RedHat-based
distributions (including CentOS, RedHat, OracleLinux, Fedora, etc.)
create a tmpfiles.d configuration file with insecure permissions which
allow attackers who are able to write files with tomcat user permissions
(for example, through a vulnerability in web application hosted on Tomcat)
to escalate their privileges from tomcat user to root and fully compromise
the target system.
Full advisory and a working root privilege escalation exploit can be found
at:
http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
BTW. If you are using Tomcat on a Debian-based distro, you may want
to check out
my previous Tomcat advisory and exploit at:
http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html
--
Regards,
Dawid Golunski
http://legalhackers.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
