full-disclosure - [FD] CVE-2016-1240 - Tomcat packaging on Debian-based distros

Open Source and information security mailing list archives

Message-ID: <CADSYzssnE7QawXU-o0tz5saHg7sYuOAzioP1Nta9jCMT3_1iFg@mail.gmail.com>
Date: Fri, 30 Sep 2016 21:13:51 -0300
From: Dawid Golunski <dawid@...alhackers.com>
To: undisclosed-recipients:;
Subject: [FD] CVE-2016-1240 - Tomcat packaging on Debian-based distros -
 Local Root Privilege Escalation

CVE: CVE-2016-1240
Vulnerability: Tomcat packaging on Debian-based distros - Local Root
Privilege Escalation
Affected packages: Tomcat 6/7/8 deb packages (up to 8.0.36-2)
Systems affected: Debian & Ubuntu & possibly others (using the
affected deb packages)

Discovered by:
Dawid Golunski (http://legalhackers.com)

Tomcat (6, 7, 8) packages provided by default repositories on Debian-based
distributions (including Debian, Ubuntu etc.) provide a vulnerable
tomcat init script that allows local attackers who have already gained access
to the tomcat account (for example, by exploiting an RCE vulnerability
in a java web application hosted on Tomcat, uploading a webshell etc.) to
escalate their privileges from tomcat user to root and fully compromise the
target system.

The full Advisory and a PoC exploit can be found at:

http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html

-- 
Regards,
Dawid Golunski
http://legalhackers.com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives