SB20200930122 - Ubuntu update for tomcat6

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2016-0762)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Provisioning (Apache Tomcat) component in Oracle Communications Diameter Signaling Router (DSR). A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

2) Security restrictions bypass (CVE-ID: CVE-2016-5018)

The vulnerability allows an application to bypass security manager restrictions on the target system.
The weakness improper access control. By invoking a certain Tomcat utility method, a malicious application can bypass a configured SecurityManager.
Successful exploitation of the vulnerability results in security bypass.

3) Information disclosure (CVE-ID: CVE-2016-6794)

The vulnerability allows an application to obtain potentially sensitive information on the target system.
The weakness is due to insufficient accesss control. By invoking the system property replacement feature, a malicious application can bypass a configured SecurityManager and read potentially sensitive system properties.
Successful exploitation of the vulnerability results in disclosure of important data on the vulnerable system.

4) Security restrictions bypass (CVE-ID: CVE-2016-6796)

The vulnerability allows an application to bypass security manager restrictions on the target system.
The weakness improper access control. By modifying of configuration parameters for the JSP Servlet, a malicious application can bypass a configured SecurityManager.
Successful exploitation of the vulnerability results in security bypass.

5) Incorrect authorization (CVE-ID: CVE-2016-6797)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to ResourceLinkFactory implementation in Apache Tomcat does not limit web application access to global JNDI resources to those resources explicitly linked to the web application. A remote unauthenticated attacker can access any global JNDI resource whether an explicit ResourceLink had been configured or not.

6) Information disclosure (CVE-ID: CVE-2016-6797)

The vulnerability allows an application to gain access to global resources on the target system.
The weakness exists due to a flaw in the ResourceLinkFactory that allows a web application to obtain global JNDI resources.
Successful exploitation of the vulnerability results in application's access to global JNDI resources on the vulnerable system.

7) Improper input validation (CVE-ID: CVE-2016-6816)

The vulnerability allows a remote attacker to manipulate HTTP responses.

The vulnerability exists due to incorrect parsing of HTTP requests. A remote attacker can send a specially crafted HTTP request containing specially crafted characters and perform XSS attacks, manipulate HTTP responses or obtain potentially sensitive data, belonging to other sessions.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information, but requires presence of a proxy server, which does not block injected characters.

8) Remote code execution (CVE-ID: CVE-2016-8735)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists within JmxRemoteLifecycleListener listener component due to usage of vulnerable Oracle code, fixed in CVE-2016-3427. A remote unauthenticated attacker with ability to connect to vulnerable listener can execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over vulnerable system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4557-1