ID

VAR-201703-0328


CVE

CVE-2016-6816


TITLE

Apache Tomcat Updates for multiple vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-007656

DESCRIPTION

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. The Apache Software Foundation From Apache Tomcat Updates for the following multiple vulnerabilities have been released: * * HTTP Response falsification (CVE-2016-6816) * * Service operation interruption (DoS) (CVE-2016-6817) * * Arbitrary code execution (CVE-2016-8735)Expected impact varies depending on each vulnerability, but information leakage, service operation interruption (DoS) May be affected by arbitrary code execution. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update Advisory ID: RHSA-2017:0455-01 Product: Red Hat JBoss Web Server Advisory URL: https://access.redhat.com/errata/RHSA-2017:0455 Issue date: 2015-11-12 Updated on: 2017-03-07 CVE Names: CVE-2016-0762 CVE-2016-1240 CVE-2016-3092 CVE-2016-5018 CVE-2016-6325 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Web Server 3 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Server 3.1 for RHEL 6 - i386, noarch, ppc64, x86_64 3. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements. Security Fix(es): * It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. (CVE-2016-1240) * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325) * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735) * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-6816) * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745) * The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762) * It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018) * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794) * It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796) * It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797) The CVE-2016-6325 issue was discovered by Red Hat Product Security. Enhancement(s): This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 6. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-267) Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement. 4. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service 1367447 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation 1376712 - CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation 1390493 - CVE-2016-6797 tomcat: unrestricted access to global resources 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters 1390520 - CVE-2016-6794 tomcat: system property disclosure 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function 1390526 - CVE-2016-0762 tomcat: timing attack in Realm implementation 1397484 - CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests 1397485 - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener 1403824 - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing 6. JIRA issues fixed (https://issues.jboss.org/): JWS-267 - RHEL 6 Errata JIRA 7. Package List: Red Hat JBoss Web Server 3.1 for RHEL 6: Source: hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.src.rpm jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.src.rpm jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.src.rpm mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.src.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el6.src.rpm tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.src.rpm tomcat7-7.0.70-16.ep7.el6.src.rpm tomcat8-8.0.36-17.ep7.el6.src.rpm i386: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.i686.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.i686.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el6.i686.rpm tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el6.i686.rpm noarch: hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-entitymanager-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-envers-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.noarch.rpm jbcs-httpd24-runtime-1-3.jbcs.el6.noarch.rpm mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm mod_cluster-tomcat7-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm mod_cluster-tomcat8-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.noarch.rpm tomcat7-7.0.70-16.ep7.el6.noarch.rpm tomcat7-admin-webapps-7.0.70-16.ep7.el6.noarch.rpm tomcat7-docs-webapp-7.0.70-16.ep7.el6.noarch.rpm tomcat7-el-2.2-api-7.0.70-16.ep7.el6.noarch.rpm tomcat7-javadoc-7.0.70-16.ep7.el6.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-16.ep7.el6.noarch.rpm tomcat7-jsvc-7.0.70-16.ep7.el6.noarch.rpm tomcat7-lib-7.0.70-16.ep7.el6.noarch.rpm tomcat7-log4j-7.0.70-16.ep7.el6.noarch.rpm tomcat7-selinux-7.0.70-16.ep7.el6.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-16.ep7.el6.noarch.rpm tomcat7-webapps-7.0.70-16.ep7.el6.noarch.rpm tomcat8-8.0.36-17.ep7.el6.noarch.rpm tomcat8-admin-webapps-8.0.36-17.ep7.el6.noarch.rpm tomcat8-docs-webapp-8.0.36-17.ep7.el6.noarch.rpm tomcat8-el-2.2-api-8.0.36-17.ep7.el6.noarch.rpm tomcat8-javadoc-8.0.36-17.ep7.el6.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-17.ep7.el6.noarch.rpm tomcat8-jsvc-8.0.36-17.ep7.el6.noarch.rpm tomcat8-lib-8.0.36-17.ep7.el6.noarch.rpm tomcat8-log4j-8.0.36-17.ep7.el6.noarch.rpm tomcat8-selinux-8.0.36-17.ep7.el6.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-17.ep7.el6.noarch.rpm tomcat8-webapps-8.0.36-17.ep7.el6.noarch.rpm ppc64: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.ppc64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.ppc64.rpm x86_64: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.x86_64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.x86_64.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el6.x86_64.rpm tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2016-0762 https://access.redhat.com/security/cve/CVE-2016-1240 https://access.redhat.com/security/cve/CVE-2016-3092 https://access.redhat.com/security/cve/CVE-2016-5018 https://access.redhat.com/security/cve/CVE-2016-6325 https://access.redhat.com/security/cve/CVE-2016-6794 https://access.redhat.com/security/cve/CVE-2016-6796 https://access.redhat.com/security/cve/CVE-2016-6797 https://access.redhat.com/security/cve/CVE-2016-6816 https://access.redhat.com/security/cve/CVE-2016-8735 https://access.redhat.com/security/cve/CVE-2016-8745 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYvww0XlSAg2UNWIIRAnJlAJ9c1cyDXP1/dI30fGjC0wJVDGbw3QCfbnXw /PBR7pUGLbNA0xtWDwAi0Xk= =Y+gP -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Those flaws allowed for privilege escalation, information disclosure, and remote code execution. As part of this update, several regressions stemming from incomplete fixes for previous vulnerabilities were also fixed. For the stable distribution (jessie), these problems have been fixed in version 7.0.56-3+deb8u6. For the testing (stretch) and unstable (sid) distributions, these problems have been fixed in version 7.0.72-3. We recommend that you upgrade your tomcat7 packages. 7) - noarch 3. Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded. (CVE-2016-8745) 4. Note: the current version of the following document is available here: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03302206 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: KM03302206 Version: 1 MFSBGN03837 rev.1 - Network Node Manager i, Multiple Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2018-12-12 Last Updated: 2018-12-12 Potential Security Impact: Remote: Cross-Site Scripting (XSS), Disclosure of Information Source: Micro Focus, Product Security Response Team VULNERABILITY SUMMARY A vulnerabilities in Apache Tomcat was addressed by Micro Focus Network Node Manager i. The vulnerability could be exploited Remote Cross-Site Scripting (XSS) and Remote Disclosure of Information References: - PSRT110650 - CVE-2016-6816 - CVE-2017-5664 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HPE Network Node Manager I (NNMi) Software 9.2x, 10.0x, 10.00 Patch 1, 10.00 Patch 2, 10.00 Patch 3, 10.00 Patch 4, 10.00 Patch 5, 10.1x, 10.10 Patch 1, 10.10 Patch 2, 10.10 Patch 3, 10.10 Patch 4, 10.2x, 10.20 Patch 1, 10.20 Patch 2, 10.20 Patch 3, 10.30, 10.30 Patch 1 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector RESOLUTION Micro Focus has made the following software updates and mitigation information to resolve the vulnerability in Micro Focus Network Node Manager i: Customers using v9.X must upgrade to v10.x and then install the patch below. Patches are available to address the vulnerabilities: For v10.0x: Network Node Manager i 10.00 Patch 8 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139745](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139745) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139763](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139763) For v10.1x: Network Node Manager i 10.10 Patch 7 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139729](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139729) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139781](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139781) For v10.2x: Network Node Manager i 10.20 Patch 6 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139701](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139701) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139715](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139715) For v10.3x: Network Node Manager i 10.30 Patch 2 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139685](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139685) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139693](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139693) HISTORY Version:1 (rev.1) - 12 December 2018 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Micro Focus products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel. For other issues about the content of this Security Bulletin, send e-mail to security@microfocus.com. Report: To report a potential security vulnerability for any supported product: Web form: https://softwaresupport.softwaregrp.com/psrt Email: security@microfocus.com Subscribe: To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.softwaregrp.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification Once you are logged in to the portal, please choose security bulletins under product and document types. Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://softwaresupport.softwaregrp.com/security-vulnerability Software Product Category: The Software Product Category is represented in the title by the two characters following Micro Focus Security Bulletin. 3P = 3rd Party Software GN = Micro Focus General Software MU = Multi-Platform Software System management and security procedures must be reviewed frequently to maintain system integrity. Micro Focus is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Micro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Micro Focus will not be responsible for any damages resulting from user's use or disregard of the information provided in this Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." Copyright Micro Focus Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Micro Focus and the names of Micro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. (CVE-2016-6816) * An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired. (CVE-2016-8627) * It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information. The References section of this erratum contains a download link (you must log in to download the update). (JIRA#JWS-268) 4

Trust: 2.52

sources: NVD: CVE-2016-6816 // JVNDB: JVNDB-2016-007656 // VULMON: CVE-2016-6816 // PACKETSTORM: 141509 // PACKETSTORM: 140199 // PACKETSTORM: 142108 // PACKETSTORM: 150775 // PACKETSTORM: 140918 // PACKETSTORM: 140914 // PACKETSTORM: 141513 // PACKETSTORM: 141510 // PACKETSTORM: 140915

AFFECTED PRODUCTS

vendor:apachemodel:tomcatscope:eqversion:9.0.0

Trust: 1.6

vendor:apachemodel:tomcatscope:eqversion:6.0.4

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.44

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.28

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.1

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.20

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.9

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.48

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.16

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.31

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.20

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.16

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.20

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.21

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.3

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.29

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.7

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.22

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.2

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.33

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.35

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.10

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.5

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.37

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.58

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.44

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.50

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.23

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.22

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.36

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.6

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.45

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.66

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.19

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.4

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.39

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.51

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.29

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.12

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.28

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.1

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.12

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.69

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.21

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.13

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.1

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.9

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.56

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.19

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.3

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.13

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.41

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.63

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.42

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.28

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.17

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.52

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.71

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.34

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.14

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.25

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.27

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.70

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.11

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.4

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.42

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.39

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.27

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.8

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.24

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.21

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.11

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.37

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.31

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.46

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.18

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.14

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.59

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.45

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.38

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.67

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.18

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.17

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.14

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.17

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.57

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.16

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.33

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.12

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.3

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.43

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.72

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.68

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.37

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.26

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.10

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.19

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.36

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.13

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.35

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.30

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.34

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.25

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.15

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.30

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.10

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.29

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.6

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.32

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.36

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.24

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.3

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.30

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.15

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.61

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.8

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.4

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.47

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.64

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.24

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.27

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.60

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.7

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.62

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.7

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.23

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.11

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.47

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.5

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.43

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.2

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.35

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.55

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.26

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.26

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.41

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.65

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.2

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.25

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.38

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.18

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.5

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.46

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.32

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.40

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.38

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.15

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.53

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.5

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.8

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.23

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.33

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.1

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.22

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.34

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.54

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.6

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.6

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.31

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.32

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.40

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.9

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.49

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.2

Trust: 1.0

vendor:apachemodel:tomcatscope:lteversion:6.0.0 from 6.0.47

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:7.0.0 from 7.0.72

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:8.0.0.rc1 from 8.0.38

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:8.5.0 from 8.5.6

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:9.0.0.m1 from 9.0.0.m11

Trust: 0.8

vendor:necmodel:mailshooterscope:eqversion: -

Trust: 0.8

vendor:necmodel:simpwrightscope:eqversion:v6

Trust: 0.8

vendor:necmodel:simpwrightscope:eqversion:v7

Trust: 0.8

vendor:necmodel:spoolserver seriesscope:eqversion:reportfiling ver5.2 to 6.2

Trust: 0.8

vendor:hitachimodel:cosminexus application server enterprisescope:eqversion:version 6

Trust: 0.8

vendor:hitachimodel:cosminexus application server standardscope:eqversion:version 6

Trust: 0.8

vendor:hitachimodel:cosminexus application server version 5scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus component containerscope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer light version 6scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer professional version 6scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer standard version 6scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer version 5scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus primary serverscope:eqversion:base version 5

Trust: 0.8

vendor:hitachimodel:cosminexus primary serverscope:eqversion:base version 6

Trust: 0.8

vendor:hitachimodel:cosminexus primary serverscope:eqversion:version 6

Trust: 0.8

vendor:hitachimodel:cosminexus studioscope:eqversion:light version

Trust: 0.8

vendor:hitachimodel:embedded cosminexus serverscope:eqversion:version 5

Trust: 0.8

vendor:hitachimodel:jp1/cm2/network node managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:jp1/network node managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:none

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:(64)

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:-r

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:express

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:light

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:standard-r

Trust: 0.8

vendor:hitachimodel:ucosminexus application server enterprisescope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus application server smart editionscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus application server standardscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:none

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:01

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:professional

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:professional for atm

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:professional for plug-in

Trust: 0.8

vendor:hitachimodel:ucosminexus developer lightscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus developer standardscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus primary serverscope:eqversion:base

Trust: 0.8

vendor:hitachimodel:ucosminexus primary serverscope:eqversion:base(64)

Trust: 0.8

vendor:hitachimodel:ucosminexus service architectscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus service platformscope:eqversion:none

Trust: 0.8

vendor:hitachimodel:ucosminexus service platformscope:eqversion:(64)

Trust: 0.8

vendor:hitachimodel:ucosminexus service platformscope:eqversion:- messaging

Trust: 0.8

vendor:hitachimodel:programming environment for javascope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2016-007656 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6816
value: HIGH

Trust: 1.0

CNNVD: CNNVD-201611-610
value: HIGH

Trust: 0.6

VULMON: CVE-2016-6816
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-6816
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

nvd@nist.gov: CVE-2016-6816
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.7
version: 3.0

Trust: 1.0

sources: VULMON: CVE-2016-6816 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

sources: NVD: CVE-2016-6816

THREAT TYPE

remote

Trust: 0.8

sources: PACKETSTORM: 140199 // PACKETSTORM: 150775 // CNNVD: CNNVD-201611-610

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201611-610

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-007656

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2016-6816

PATCH

title:Fixed in Apache Tomcat 8.0.39url:https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39

Trust: 0.8

title:Fixed in Apache Tomcat 7.0.73url:https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73

Trust: 0.8

title:Fixed in Apache Tomcat 6.0.48url:https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48

Trust: 0.8

title:Fixed in Apache Tomcat 9.0.0.M13url:https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13

Trust: 0.8

title:Fixed in Apache Tomcat 8.5.8url:https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

Trust: 0.8

title:hitachi-sec-2017-107url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-107/index.html

Trust: 0.8

title:hitachi-sec-2019-107url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-107/index.html

Trust: 0.8

title:NV17-002url:http://jpn.nec.com/security-info/secinfo/nv17-002.html

Trust: 0.8

title:hitachi-sec-2017-107url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-107/index.html

Trust: 0.8

title:hitachi-sec-2019-107url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2019-107/index.html

Trust: 0.8

title:Apache Tomcat Repair measures for security bypass vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66051

Trust: 0.6

title:Red Hat: Moderate: tomcat6 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170527 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: tomcat security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170935 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170247 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170245 - Security Advisory

Trust: 0.1

title:Red Hat: Important: jboss-ec2-eap security, bug fix, and enhancement updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170250 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170244 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170246 - Security Advisory

Trust: 0.1

title:Red Hat: CVE-2016-6816url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2016-6816

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Web Server security and enhancement updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170457 - Security Advisory

Trust: 0.1

title:Amazon Linux AMI: ALAS-2017-810url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2017-810

Trust: 0.1

title:Amazon Linux AMI: ALAS-2016-777url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-777

Trust: 0.1

title:Amazon Linux AMI: ALAS-2016-778url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-778

Trust: 0.1

title:Amazon Linux AMI: ALAS-2016-776url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-776

Trust: 0.1

title:Debian Security Advisories: DSA-3738-1 tomcat7 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=8828b9876ebd1ef3e89b0ed4e9499abe

Trust: 0.1

title:Debian Security Advisories: DSA-3739-1 tomcat8 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=98ef9e44fdad2be0b98f03550515e81a

Trust: 0.1

title:Arch Linux Advisories: [ASA-201611-22] tomcat6: multiple issuesurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201611-22

Trust: 0.1

title:Hitachi Security Advisories: Multiple Vulnerabilities in JP1/Network Node Manager iurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2019-107

Trust: 0.1

title:Ubuntu Security Notice: tomcat6, tomcat7 regressionurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3177-2

Trust: 0.1

title:Debian CVElist Bug Report Logs: CVE-2016-9774: privilege escalation via upgradeurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=8cd48a33e8df530a4a18a79eb337a877

Trust: 0.1

title:Debian CVElist Bug Report Logs: CVE-2016-9775: privilege escalation via removalurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=e3359df45e6e8201a268a6c465717fa5

Trust: 0.1

title:Ubuntu Security Notice: tomcat6, tomcat7, tomcat8 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3177-1

Trust: 0.1

title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a2bac27fb002bed513645d4775c7275b

Trust: 0.1

title:Oracle Linux Bulletins: Oracle Linux Bulletin - January 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=ecbe5f193404d1e9c62e8323118ae6cf

Trust: 0.1

title:Oracle Linux Bulletins: Oracle Linux Bulletin - April 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=d78b3379ca364568964f30138964c7e7

Trust: 0.1

title:Oracle: Oracle Critical Patch Update Advisory - April 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=143b3fb255063c81571469eaa3cf0a87

Trust: 0.1

title:Oracle: Oracle Critical Patch Update Advisory - October 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=523d3f220a64ff01dd95e064bd37566a

Trust: 0.1

title:penetration tools Donation Thanks tourl:https://github.com/touchmycrazyredhat/myhktools

Trust: 0.1

title:penetration tools Donation Donation Thanks to 先知论坛推荐过本项目“2.1.3 Web 框架” myhktoolsurl:https://github.com/hktalent/myhktools

Trust: 0.1

title:A2:2017 Broken Authentication A5:2017 Broken Access Control A3:2017 Sensitive Data Exposure A6:2017 Security Misconfiguration A9:2017 Using Components with Known Vulnerabilities A10:2017 Insufficient Logging & Monitoringurl:https://github.com/ilmari666/cybsec

Trust: 0.1

title:veracode-container-security-finding-parserurl:https://github.com/vincent-deng/veracode-container-security-finding-parser

Trust: 0.1

sources: VULMON: CVE-2016-6816 // JVNDB: JVNDB-2016-007656 // CNNVD: CNNVD-201611-610

EXTERNAL IDS

db:NVDid:CVE-2016-6816

Trust: 3.4

db:BIDid:94461

Trust: 1.7

db:SECTRACKid:1037332

Trust: 1.7

db:EXPLOIT-DBid:41783

Trust: 1.7

db:JVNid:JVNVU92250735

Trust: 0.8

db:JVNDBid:JVNDB-2016-007656

Trust: 0.8

db:PACKETSTORMid:159413

Trust: 0.6

db:AUSCERTid:ESB-2020.3415

Trust: 0.6

db:AUSCERTid:ESB-2019.1276

Trust: 0.6

db:CNNVDid:CNNVD-201611-610

Trust: 0.6

db:VULMONid:CVE-2016-6816

Trust: 0.1

db:PACKETSTORMid:141509

Trust: 0.1

db:PACKETSTORMid:140199

Trust: 0.1

db:PACKETSTORMid:142108

Trust: 0.1

db:PACKETSTORMid:150775

Trust: 0.1

db:PACKETSTORMid:140918

Trust: 0.1

db:PACKETSTORMid:140914

Trust: 0.1

db:PACKETSTORMid:141513

Trust: 0.1

db:PACKETSTORMid:141510

Trust: 0.1

db:PACKETSTORMid:140915

Trust: 0.1

sources: VULMON: CVE-2016-6816 // JVNDB: JVNDB-2016-007656 // PACKETSTORM: 141509 // PACKETSTORM: 140199 // PACKETSTORM: 142108 // PACKETSTORM: 150775 // PACKETSTORM: 140918 // PACKETSTORM: 140914 // PACKETSTORM: 141513 // PACKETSTORM: 141510 // PACKETSTORM: 140915 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

REFERENCES

url:http://www.securityfocus.com/bid/94461

Trust: 2.4

url:http://www.debian.org/security/2016/dsa-3738

Trust: 2.3

url:https://www.exploit-db.com/exploits/41783/

Trust: 1.8

url:https://access.redhat.com/errata/rhsa-2017:0935

Trust: 1.8

url:https://access.redhat.com/errata/rhsa-2017:0456

Trust: 1.8

url:https://access.redhat.com/errata/rhsa-2017:0455

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2017-0457.html

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2017-0250.html

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2017-0247.html

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2017-0246.html

Trust: 1.8

url:https://tomcat.apache.org/security-9.html#fixed_in_apache_tomcat_9.0.0.m13

Trust: 1.7

url:https://tomcat.apache.org/security-8.html#fixed_in_apache_tomcat_8.5.8

Trust: 1.7

url:https://tomcat.apache.org/security-8.html#fixed_in_apache_tomcat_8.0.39

Trust: 1.7

url:https://tomcat.apache.org/security-7.html#fixed_in_apache_tomcat_7.0.73

Trust: 1.7

url:https://tomcat.apache.org/security-6.html#fixed_in_apache_tomcat_6.0.48

Trust: 1.7

url:http://www.securitytracker.com/id/1037332

Trust: 1.7

url:http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0527.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0245.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0244.html

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20180607-0001/

Trust: 1.7

url:https://usn.ubuntu.com/4557-1/

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2016-6816

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2016-8735

Trust: 1.2

url:https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://access.redhat.com/security/cve/cve-2016-6816

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6816

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6817

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8735

Trust: 0.8

url:http://jvn.jp/vu/jvnvu92250735/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2016-6817

Trust: 0.8

url:https://access.redhat.com/security/team/contact/

Trust: 0.7

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.7

url:https://bugzilla.redhat.com/):

Trust: 0.7

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.6

url:https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-107/index.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/79014

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3415/

Trust: 0.6

url:https://packetstormsecurity.com/files/159413/ubuntu-security-notice-usn-4557-1.html

Trust: 0.6

url:https://access.redhat.com/articles/11258

Trust: 0.5

url:https://access.redhat.com/security/team/key/

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2016-8745

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2016-8745

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2016-6325

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6796

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6325

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-8735

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-1240

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6794

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-5018

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-6797

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-6796

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6797

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-0762

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-3092

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-5018

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-3092

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-1240

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-0762

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-6794

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-8627

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-7061

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-8656

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-8656

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-7061

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2016-8627

Trust: 0.3

url:https://issues.jboss.org/):

Trust: 0.2

url:https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform/

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2017:0527

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://usn.ubuntu.com/3177-2/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-9775

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-9774

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.1

url:https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/

Trust: 0.1

url:https://cf.passport.softwaregrp.com/hppcf/createuser.do

Trust: 0.1

url:https://softwaresupport.softwaregrp.com/psrt

Trust: 0.1

url:https://softwaresupport.softwaregrp.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification

Trust: 0.1

url:https://softwaresupport.softwaregrp.com/gro

Trust: 0.1

url:https://softwaresupport.softwaregrp.com/security-vulnerability

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2017-5664

Trust: 0.1

url:https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/km03302206

Trust: 0.1

url:https://access.redhat.com/solutions/2435491

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/3/html-single/3.1_release_notes/index.html

Trust: 0.1

url:https://access.redhat.com/security/vulnerabilities/httpoxy

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=webserver&version=3.1.0

Trust: 0.1

url:https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=appplatform&downloadtype=securitypatches&version=6.4

Trust: 0.1

sources: VULMON: CVE-2016-6816 // JVNDB: JVNDB-2016-007656 // PACKETSTORM: 141509 // PACKETSTORM: 140199 // PACKETSTORM: 142108 // PACKETSTORM: 150775 // PACKETSTORM: 140918 // PACKETSTORM: 140914 // PACKETSTORM: 141513 // PACKETSTORM: 141510 // PACKETSTORM: 140915 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

CREDITS

Red Hat

Trust: 0.7

sources: PACKETSTORM: 141509 // PACKETSTORM: 142108 // PACKETSTORM: 140918 // PACKETSTORM: 140914 // PACKETSTORM: 141513 // PACKETSTORM: 141510 // PACKETSTORM: 140915

SOURCES

db:VULMONid:CVE-2016-6816
db:JVNDBid:JVNDB-2016-007656
db:PACKETSTORMid:141509
db:PACKETSTORMid:140199
db:PACKETSTORMid:142108
db:PACKETSTORMid:150775
db:PACKETSTORMid:140918
db:PACKETSTORMid:140914
db:PACKETSTORMid:141513
db:PACKETSTORMid:141510
db:PACKETSTORMid:140915
db:CNNVDid:CNNVD-201611-610
db:NVDid:CVE-2016-6816

LAST UPDATE DATE

2024-11-20T21:17:09.411000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2016-6816date:2023-12-08T00:00:00
db:JVNDBid:JVNDB-2016-007656date:2019-04-12T00:00:00
db:CNNVDid:CNNVD-201611-610date:2020-10-22T00:00:00
db:NVDid:CVE-2016-6816date:2023-12-08T16:41:18.860

SOURCES RELEASE DATE

db:VULMONid:CVE-2016-6816date:2017-03-20T00:00:00
db:JVNDBid:JVNDB-2016-007656date:2017-03-09T00:00:00
db:PACKETSTORMid:141509date:2017-03-08T00:54:47
db:PACKETSTORMid:140199date:2016-12-18T13:55:00
db:PACKETSTORMid:142108date:2017-04-12T23:47:55
db:PACKETSTORMid:150775date:2018-12-13T18:21:43
db:PACKETSTORMid:140918date:2017-02-03T15:54:27
db:PACKETSTORMid:140914date:2017-02-03T15:53:54
db:PACKETSTORMid:141513date:2017-03-08T00:57:19
db:PACKETSTORMid:141510date:2017-03-08T00:55:08
db:PACKETSTORMid:140915date:2017-02-03T15:54:03
db:CNNVDid:CNNVD-201611-610date:2016-11-22T00:00:00
db:NVDid:CVE-2016-6816date:2017-03-20T18:59:00.173