Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 10 Oct 2016 04:32:57 -0300
From: Dawid Golunski <>
Subject: CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros -
 Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.)

Vulnerability: Apache Tomcat packaging on RedHat-based distros


Discovered by:
Dawid Golunski (

Affected systems: Multiple Tomcat packages on RedHat-based systems
including: CentOS,Fedora,OracleLinux,RedHat etc.

Short Description:

Apache Tomcat packages provided by default repositories of RedHat-based
distributions (including CentOS, RedHat, OracleLinux, Fedora,  etc.)
create a tmpfiles.d configuration file with insecure permissions which
allow attackers who are able to write files with tomcat user permissions
(for example, through a vulnerability in web application hosted on Tomcat)
to escalate their privileges from tomcat user to root and fully compromise
the target system.

Full advisory and a working root privilege escalation exploit can be found

BTW. If you are using Tomcat on a Debian-based distro,  you may want
to check out
my previous Tomcat advisory and exploit at:

Dawid Golunski

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.