[Bug 1420125] New: CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1420125
Bug ID: 1420125
Summary: CVE-2016-6325 tomcat: tomcat writable config files
allow privilege escalation
Product: Fedora EPEL
Version: epel7
Component: tomcat
Severity: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: jjasen(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
fnasser(a)redhat.com, gzaronik(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jdoyle(a)redhat.com,
krzysztof.daniel(a)gmail.com, lgao(a)redhat.com,
mbabacek(a)redhat.com, me(a)coolsvap.net,
myarboro(a)redhat.com,
security-response-team(a)redhat.com, thoger(a)redhat.com,
trick(a)vanstaveren.us, twalsh(a)redhat.com,
weli(a)redhat.com
+++ This bug was initially created as a clone of Bug #1367447 +++
It was discovered that Tomcat packages in certain versions of Red Hat
Enterprise Linux use incorrect permissions for /etc/sysconfig/tomcat
configuration files. The file is writable to tomcat group (root:tomcat, 664).
On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise
Linux 6 and earlier), the file is sourced by the Tomcat init script and its
content executed with root privileges when Tomcat service is started, stopped
or restarted.
On Red Hat Enterprise Linux 7 using systemd, the file is not longer directly
executed with root privileges, but it's still used to initialize environment
for the Tomcat service. This would not allow a malicious or compromised web
application deployed on Tomcat and already running with tomcat user privileges
to directly escalate privileges.
--- Additional comment from Tomas Hoger on 2016-08-16 08:33:17 EDT ---
Acknowledgments:
Name: Red Hat Product Security
--- Additional comment from Tomas Hoger on 2016-08-16 09:15:52 EDT ---
In addition to /etc/sysconfig/tomcat, the same applies to
/etc/tomcat/tomcat.conf which is also sourced by Tomcat init script.
Note that Tomcat package name vary between Red Hat Enterprise Linux versions,
which also means these configuration files have slightly different names on
different OS versions.
Red Hat Enterprise Linux 7:
/etc/sysconfig/tomcat
/etc/tomcat/tomcat.conf
Red Hat Enterprise Linux 6:
/etc/sysconfig/tomcat6
/etc/tomcat6/tomcat6.conf
Red Hat Enterprise Linux 5:
/etc/sysconfig/tomcat5
/etc/tomcat5/tomcat5.conf
--- Additional comment from Tomas Hoger on 2016-08-18 06:54:20 EDT ---
Note that to properly fix this, we'll also need to fix permissions of the
/etc/tomcat directory. As the directory is usually created as writable to
tomcat user or group, even if tomcat.conf inside it is not tomcat writable, it
is still possible to remove and re-create the file.
--- Additional comment from Tomas Hoger on 2016-09-16 10:19:52 EDT ---
This issue can be mitigated by manually changing permissions of configuration
files and directories. The following commands should be invoked as root. Note
that the file permissions may be changed again on the next package upgrade.
Red Hat Enterprise Linux 7, tomcat packages:
# chown root /etc/tomcat/tomcat.conf
# chmod 644 /etc/sysconfig/tomcat /etc/tomcat/tomcat.conf
Note that /etc/tomcat/ is not writeable to the tomcat user by default.
Red Hat Enterprise Linux 6, tomcat6 packages:
# chmod 755 /etc/tomcat6/
# chmod 644 /etc/sysconfig/tomcat6 /etc/tomcat6/tomcat6.conf
Red Hat Enterprise Linux 5, tomcat5 packages:
# chmod 755 /etc/tomcat5/
Note that /etc/sysconfig/tomcat5 and /etc/tomcat5/tomcat5.conf configuration
files are already root-owned and not writeable to tomcat user.
--- Additional comment from Tomas Hoger on 2016-10-10 04:32:39 EDT ---
Lifting embargo after CVE-2016-5425 issue was made public - see bug 1362545
comment 10.
--- Additional comment from Tomas Hoger on 2016-10-10 04:36:09 EDT ---
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 1383216]
--- Additional comment from errata-xmlrpc on 2016-10-10 16:42:03 EDT ---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:2046 https://rhn.redhat.com/errata/RHSA-2016-2046.html
--- Additional comment from errata-xmlrpc on 2016-10-10 16:44:02 EDT ---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2016:2045 https://rhn.redhat.com/errata/RHSA-2016-2045.html
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 2 months
[Bug 1419705] New: Fedora has old SBT version
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1419705
Bug ID: 1419705
Summary: Fedora has old SBT version
Product: Fedora
Version: 25
Component: sbt
Assignee: willb(a)redhat.com
Reporter: demetriobenour(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com
Description of problem:
SBT version is old
Version-Release number of selected component (if applicable):
0.13.1
How reproducible:
Always
Steps to Reproduce:
1. Install sbt
2. Run sbt --version
Actual results:
Version is 0.13.1
Expected results:
Version is 0.13.13
Additional info:
SBT 0.13.13 is latest.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 2 months
[Bug 1419706] New: SBT version is old
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1419706
Bug ID: 1419706
Summary: SBT version is old
Product: Fedora
Version: 25
Component: sbt
Assignee: willb(a)redhat.com
Reporter: demetriobenour(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com
Description of problem:
Old SBT version
Version-Release number of selected component (if applicable):
0.13.1
How reproducible:
Always
Steps to Reproduce:
1. Install sbt
2. Run sbt --version
Actual results:
0.13.1
Expected results:
0.13.13
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 2 months