ID

VAR-201703-0328


CVE

CVE-2016-6816


TITLE

Apache Tomcat Updates for multiple vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-007656

DESCRIPTION

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. The Apache Software Foundation From Apache Tomcat Updates for the following multiple vulnerabilities have been released: * * HTTP Response falsification (CVE-2016-6816) * * Service operation interruption (DoS) (CVE-2016-6817) * * Arbitrary code execution (CVE-2016-8735)Expected impact varies depending on each vulnerability, but information leakage, service operation interruption (DoS) May be affected by arbitrary code execution. Apache Tomcat is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0.47 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update Advisory ID: RHSA-2017:0455-01 Product: Red Hat JBoss Web Server Advisory URL: https://access.redhat.com/errata/RHSA-2017:0455 Issue date: 2015-11-12 Updated on: 2017-03-07 CVE Names: CVE-2016-0762 CVE-2016-1240 CVE-2016-3092 CVE-2016-5018 CVE-2016-6325 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Web Server 3 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Server 3.1 for RHEL 6 - i386, noarch, ppc64, x86_64 3. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements. Security Fix(es): * It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. (CVE-2016-1240) * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325) * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735) * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-6816) * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745) * The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762) * It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018) * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794) * It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796) * It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797) The CVE-2016-6325 issue was discovered by Red Hat Product Security. Enhancement(s): This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 6. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-267) Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement. 4. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service 1367447 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation 1376712 - CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation 1390493 - CVE-2016-6797 tomcat: unrestricted access to global resources 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters 1390520 - CVE-2016-6794 tomcat: system property disclosure 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function 1390526 - CVE-2016-0762 tomcat: timing attack in Realm implementation 1397484 - CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests 1397485 - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener 1403824 - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing 6. JIRA issues fixed (https://issues.jboss.org/): JWS-267 - RHEL 6 Errata JIRA 7. Package List: Red Hat JBoss Web Server 3.1 for RHEL 6: Source: hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.src.rpm jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.src.rpm jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.src.rpm mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.src.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el6.src.rpm tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.src.rpm tomcat7-7.0.70-16.ep7.el6.src.rpm tomcat8-8.0.36-17.ep7.el6.src.rpm i386: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.i686.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.i686.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el6.i686.rpm tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el6.i686.rpm noarch: hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-entitymanager-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm hibernate4-envers-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6.noarch.rpm jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el6.noarch.rpm jbcs-httpd24-runtime-1-3.jbcs.el6.noarch.rpm mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm mod_cluster-tomcat7-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm mod_cluster-tomcat8-1.3.5-2.Final_redhat_2.1.ep7.el6.noarch.rpm tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el6.noarch.rpm tomcat7-7.0.70-16.ep7.el6.noarch.rpm tomcat7-admin-webapps-7.0.70-16.ep7.el6.noarch.rpm tomcat7-docs-webapp-7.0.70-16.ep7.el6.noarch.rpm tomcat7-el-2.2-api-7.0.70-16.ep7.el6.noarch.rpm tomcat7-javadoc-7.0.70-16.ep7.el6.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-16.ep7.el6.noarch.rpm tomcat7-jsvc-7.0.70-16.ep7.el6.noarch.rpm tomcat7-lib-7.0.70-16.ep7.el6.noarch.rpm tomcat7-log4j-7.0.70-16.ep7.el6.noarch.rpm tomcat7-selinux-7.0.70-16.ep7.el6.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-16.ep7.el6.noarch.rpm tomcat7-webapps-7.0.70-16.ep7.el6.noarch.rpm tomcat8-8.0.36-17.ep7.el6.noarch.rpm tomcat8-admin-webapps-8.0.36-17.ep7.el6.noarch.rpm tomcat8-docs-webapp-8.0.36-17.ep7.el6.noarch.rpm tomcat8-el-2.2-api-8.0.36-17.ep7.el6.noarch.rpm tomcat8-javadoc-8.0.36-17.ep7.el6.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-17.ep7.el6.noarch.rpm tomcat8-jsvc-8.0.36-17.ep7.el6.noarch.rpm tomcat8-lib-8.0.36-17.ep7.el6.noarch.rpm tomcat8-log4j-8.0.36-17.ep7.el6.noarch.rpm tomcat8-selinux-8.0.36-17.ep7.el6.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-17.ep7.el6.noarch.rpm tomcat8-webapps-8.0.36-17.ep7.el6.noarch.rpm ppc64: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.ppc64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.ppc64.rpm x86_64: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el6.x86_64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el6.x86_64.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el6.x86_64.rpm tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2016-0762 https://access.redhat.com/security/cve/CVE-2016-1240 https://access.redhat.com/security/cve/CVE-2016-3092 https://access.redhat.com/security/cve/CVE-2016-5018 https://access.redhat.com/security/cve/CVE-2016-6325 https://access.redhat.com/security/cve/CVE-2016-6794 https://access.redhat.com/security/cve/CVE-2016-6796 https://access.redhat.com/security/cve/CVE-2016-6797 https://access.redhat.com/security/cve/CVE-2016-6816 https://access.redhat.com/security/cve/CVE-2016-8735 https://access.redhat.com/security/cve/CVE-2016-8745 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYvww0XlSAg2UNWIIRAnJlAJ9c1cyDXP1/dI30fGjC0wJVDGbw3QCfbnXw /PBR7pUGLbNA0xtWDwAi0Xk= =Y+gP -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3738-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond December 18, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tomcat7 CVE ID : CVE-2016-6816 CVE-2016-8735 CVE-2016-9774 CVE-2016-9775 Debian Bug : 802312 845385 845393 Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution. As part of this update, several regressions stemming from incomplete fixes for previous vulnerabilities were also fixed. For the stable distribution (jessie), these problems have been fixed in version 7.0.56-3+deb8u6. For the testing (stretch) and unstable (sid) distributions, these problems have been fixed in version 7.0.72-3. We recommend that you upgrade your tomcat7 packages. =========================================================================== Ubuntu Security Notice USN-3177-1 January 23, 2017 tomcat6, tomcat7, tomcat8 vulnerabilities =========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Tomcat. Software Description: - tomcat8: Servlet and JSP engine - tomcat7: Servlet and JSP engine - tomcat6: Servlet and JSP engine Details: It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5018) It was discovered that Tomcat did not protect applications from untrusted data in the HTTP_PROXY environment variable. A remote attacker could possibly use this issue to redirect outbound traffic to an arbitrary proxy server. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5388) It was discovered that Tomcat incorrectly controlled reading system properties. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6816) Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did not implement a recommended fix. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2016-8745) Paul Szabo discovered that the Tomcat package incorrectly handled upgrades and removals. A local attacker could possibly use this issue to obtain root privileges. (CVE-2016-9774, CVE-2016-9775) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: libtomcat8-java 8.0.37-1ubuntu0.1 tomcat8 8.0.37-1ubuntu0.1 Ubuntu 16.04 LTS: libtomcat8-java 8.0.32-1ubuntu1.3 tomcat8 8.0.32-1ubuntu1.3 Ubuntu 14.04 LTS: libtomcat7-java 7.0.52-1ubuntu0.8 tomcat7 7.0.52-1ubuntu0.8 Ubuntu 12.04 LTS: libtomcat6-java 6.0.35-1ubuntu3.9 tomcat6 6.0.35-1ubuntu3.9 In general, a standard system update will make all the necessary changes. (CVE-2016-6816) * An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired. (CVE-2016-8627) * It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information. (JIRA#JWS-268) 4. The References section of this erratum contains a download link (you must log in to download the update)

Trust: 2.52

sources: NVD: CVE-2016-6816 // JVNDB: JVNDB-2016-007656 // BID: 94461 // VULMON: CVE-2016-6816 // PACKETSTORM: 141509 // PACKETSTORM: 140199 // PACKETSTORM: 140692 // PACKETSTORM: 140917 // PACKETSTORM: 141510 // PACKETSTORM: 140915

AFFECTED PRODUCTS

vendor:apachemodel:tomcatscope:eqversion:9.0.0

Trust: 1.6

vendor:apachemodel:tomcatscope:eqversion:8.5.5

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.5.4

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.38

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.37

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.36

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.35

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.34

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.33

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.30

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.27

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.17

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.15

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.9

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.8

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.5

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.3

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.1

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.72

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.70

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.69

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.67

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.65

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.59

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.57

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.54

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.53

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.50

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.33

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.32

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.31

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.30

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.29

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.28

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.27

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.26

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.25

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.24

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.23

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.16

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.15

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.14

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.13

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.12

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.9

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.8

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.7

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.6

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.4

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.3

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.2

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.1

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.47

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.44

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.43

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.41

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.37

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.36

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.35

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.28

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.27

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.26

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.25

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.24

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.20

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.18

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.17

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.16

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.15

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.14

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.13

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.12

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.11

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.10

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.9

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.8

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.7

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.6

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.5

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.4

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.3

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.2

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.1

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.5.3

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.5.2

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.5.0

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.32

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.68

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.55

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.5

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.49

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.48

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.47

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.46

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.45

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.44

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.43

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.42

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.41

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.40

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.39

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.38

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.37

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.36

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.35

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.34

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.22

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.21

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.20

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.19

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.18

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.11

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:7.0.10

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.45

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.42

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.39

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.33

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.32

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.31

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.30

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.29

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:6.0.19

Trust: 1.3

vendor:apachemodel:tomcatscope:eqversion:8.0.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.20

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.16

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.21

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.29

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.7

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.22

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.58

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.23

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.6

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.66

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.19

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.4

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.51

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.12

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.28

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.21

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.13

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.1

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.56

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.63

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.52

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.71

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.34

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.25

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.11

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.24

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.38

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.17

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.14

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.0

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.10

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.61

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.64

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.60

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:7.0.62

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.23

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.26

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.2

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.18

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.46

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.40

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:6.0.22

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.5.6

Trust: 1.0

vendor:apachemodel:tomcatscope:eqversion:8.0.31

Trust: 1.0

vendor:apachemodel:tomcatscope:lteversion:6.0.0 from 6.0.47

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:7.0.0 from 7.0.72

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:8.0.0.rc1 from 8.0.38

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:8.5.0 from 8.5.6

Trust: 0.8

vendor:apachemodel:tomcatscope:lteversion:9.0.0.m1 from 9.0.0.m11

Trust: 0.8

vendor:necmodel:mailshooterscope:eqversion: -

Trust: 0.8

vendor:necmodel:simpwrightscope:eqversion:v6

Trust: 0.8

vendor:necmodel:simpwrightscope:eqversion:v7

Trust: 0.8

vendor:necmodel:spoolserver seriesscope:eqversion:reportfiling ver5.2 to 6.2

Trust: 0.8

vendor:hitachimodel:cosminexus application server enterprisescope:eqversion:version 6

Trust: 0.8

vendor:hitachimodel:cosminexus application server standardscope:eqversion:version 6

Trust: 0.8

vendor:hitachimodel:cosminexus application server version 5scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus component containerscope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer light version 6scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer professional version 6scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer standard version 6scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus developer version 5scope: - version: -

Trust: 0.8

vendor:hitachimodel:cosminexus primary serverscope:eqversion:base version 5

Trust: 0.8

vendor:hitachimodel:cosminexus primary serverscope:eqversion:base version 6

Trust: 0.8

vendor:hitachimodel:cosminexus primary serverscope:eqversion:version 6

Trust: 0.8

vendor:hitachimodel:cosminexus studioscope:eqversion:light version

Trust: 0.8

vendor:hitachimodel:embedded cosminexus serverscope:eqversion:version 5

Trust: 0.8

vendor:hitachimodel:jp1/cm2/network node managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:jp1/network node managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:none

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:(64)

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:-r

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:express

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:light

Trust: 0.8

vendor:hitachimodel:ucosminexus application serverscope:eqversion:standard-r

Trust: 0.8

vendor:hitachimodel:ucosminexus application server enterprisescope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus application server smart editionscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus application server standardscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:none

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:01

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:professional

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:professional for atm

Trust: 0.8

vendor:hitachimodel:ucosminexus developerscope:eqversion:professional for plug-in

Trust: 0.8

vendor:hitachimodel:ucosminexus developer lightscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus developer standardscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus primary serverscope:eqversion:base

Trust: 0.8

vendor:hitachimodel:ucosminexus primary serverscope:eqversion:base(64)

Trust: 0.8

vendor:hitachimodel:ucosminexus service architectscope: - version: -

Trust: 0.8

vendor:hitachimodel:ucosminexus service platformscope:eqversion:none

Trust: 0.8

vendor:hitachimodel:ucosminexus service platformscope:eqversion:(64)

Trust: 0.8

vendor:hitachimodel:ucosminexus service platformscope:eqversion:- messaging

Trust: 0.8

vendor:hitachimodel:programming environment for javascope: - version: -

Trust: 0.8

vendor:redhatmodel:enterprise linux workstation optionalscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux workstation optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux server optionalscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux server optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc node optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux computenode optionalscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux computenodescope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux client optionalscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux clientscope:eqversion:7

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:11.3

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:10

Trust: 0.3

vendor:oraclemodel:secure global desktopscope:eqversion:5.3

Trust: 0.3

vendor:oraclemodel:secure global desktopscope:eqversion:5.2

Trust: 0.3

vendor:oraclemodel:secure global desktopscope:eqversion:4.71

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:7

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:7

Trust: 0.3

vendor:apachemodel:tomcatscope:eqversion:7.0

Trust: 0.3

vendor:apachemodel:tomcatscope:eqversion:6.0

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0m8scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0m6scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m9scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m5scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m4scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m3scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m2scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m11scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m10scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m1scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 8.0.0.rc1scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 8.0.0-rc6scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 8.0.0-rc5scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 8.0.0-rc3scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat 8.0.0-rc10scope: - version: -

Trust: 0.3

vendor:apachemodel:tomcat rc1scope:eqversion:8.0.0

Trust: 0.3

vendor:apachemodel:tomcatscope:neversion:8.5.8

Trust: 0.3

vendor:apachemodel:tomcatscope:neversion:8.0.39

Trust: 0.3

vendor:apachemodel:tomcatscope:neversion:7.0.73

Trust: 0.3

vendor:apachemodel:tomcatscope:neversion:6.0.48

Trust: 0.3

vendor:apachemodel:tomcat 9.0.0.m13scope:neversion: -

Trust: 0.3

sources: BID: 94461 // JVNDB: JVNDB-2016-007656 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6816
value: HIGH

Trust: 1.0

CNNVD: CNNVD-201611-610
value: HIGH

Trust: 0.6

VULMON: CVE-2016-6816
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-6816
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

nvd@nist.gov: CVE-2016-6816
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.7
version: 3.0

Trust: 1.0

sources: VULMON: CVE-2016-6816 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

sources: NVD: CVE-2016-6816

THREAT TYPE

remote

Trust: 0.8

sources: PACKETSTORM: 140199 // PACKETSTORM: 140692 // CNNVD: CNNVD-201611-610

TYPE

Input Validation Error

Trust: 0.9

sources: BID: 94461 // CNNVD: CNNVD-201611-610

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-007656

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2016-6816

PATCH

title:Fixed in Apache Tomcat 8.0.39url:https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39

Trust: 0.8

title:Fixed in Apache Tomcat 7.0.73url:https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73

Trust: 0.8

title:Fixed in Apache Tomcat 6.0.48url:https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48

Trust: 0.8

title:Fixed in Apache Tomcat 9.0.0.M13url:https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13

Trust: 0.8

title:Fixed in Apache Tomcat 8.5.8url:https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

Trust: 0.8

title:hitachi-sec-2017-107url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-107/index.html

Trust: 0.8

title:hitachi-sec-2019-107url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-107/index.html

Trust: 0.8

title:NV17-002url:http://jpn.nec.com/security-info/secinfo/nv17-002.html

Trust: 0.8

title:hitachi-sec-2017-107url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-107/index.html

Trust: 0.8

title:hitachi-sec-2019-107url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2019-107/index.html

Trust: 0.8

title:Apache Tomcat Repair measures for security bypass vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66051

Trust: 0.6

title:Red Hat: Moderate: tomcat6 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170527 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: tomcat security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170935 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170247 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170245 - Security Advisory

Trust: 0.1

title:Red Hat: Important: jboss-ec2-eap security, bug fix, and enhancement updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170250 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170244 - Security Advisory

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Enterprise Application Platform security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170246 - Security Advisory

Trust: 0.1

title:Red Hat: CVE-2016-6816url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2016-6816

Trust: 0.1

title:Red Hat: Important: Red Hat JBoss Web Server security and enhancement updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20170457 - Security Advisory

Trust: 0.1

title:Amazon Linux AMI: ALAS-2017-810url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2017-810

Trust: 0.1

title:Amazon Linux AMI: ALAS-2016-777url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-777

Trust: 0.1

title:Amazon Linux AMI: ALAS-2016-778url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-778

Trust: 0.1

title:Amazon Linux AMI: ALAS-2016-776url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-776

Trust: 0.1

title:Debian Security Advisories: DSA-3738-1 tomcat7 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=8828b9876ebd1ef3e89b0ed4e9499abe

Trust: 0.1

title:Debian Security Advisories: DSA-3739-1 tomcat8 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=98ef9e44fdad2be0b98f03550515e81a

Trust: 0.1

title:Arch Linux Advisories: [ASA-201611-22] tomcat6: multiple issuesurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201611-22

Trust: 0.1

title:Hitachi Security Advisories: Multiple Vulnerabilities in JP1/Network Node Manager iurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2019-107

Trust: 0.1

title:Ubuntu Security Notice: tomcat6, tomcat7 regressionurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3177-2

Trust: 0.1

title:Debian CVElist Bug Report Logs: CVE-2016-9774: privilege escalation via upgradeurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=8cd48a33e8df530a4a18a79eb337a877

Trust: 0.1

title:Debian CVElist Bug Report Logs: CVE-2016-9775: privilege escalation via removalurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=e3359df45e6e8201a268a6c465717fa5

Trust: 0.1

title:Ubuntu Security Notice: tomcat6, tomcat7, tomcat8 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3177-1

Trust: 0.1

title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a2bac27fb002bed513645d4775c7275b

Trust: 0.1

title:Oracle Linux Bulletins: Oracle Linux Bulletin - January 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=ecbe5f193404d1e9c62e8323118ae6cf

Trust: 0.1

title:Oracle Linux Bulletins: Oracle Linux Bulletin - April 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=d78b3379ca364568964f30138964c7e7

Trust: 0.1

title:Oracle: Oracle Critical Patch Update Advisory - April 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=143b3fb255063c81571469eaa3cf0a87

Trust: 0.1

title:Oracle: Oracle Critical Patch Update Advisory - October 2017url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=523d3f220a64ff01dd95e064bd37566a

Trust: 0.1

title:penetration tools Donation Thanks tourl:https://github.com/touchmycrazyredhat/myhktools

Trust: 0.1

title:penetration tools Donation Donation Thanks to 先知论坛推荐过本项目“2.1.3 Web 框架” myhktoolsurl:https://github.com/hktalent/myhktools

Trust: 0.1

title:A2:2017 Broken Authentication A5:2017 Broken Access Control A3:2017 Sensitive Data Exposure A6:2017 Security Misconfiguration A9:2017 Using Components with Known Vulnerabilities A10:2017 Insufficient Logging & Monitoringurl:https://github.com/ilmari666/cybsec

Trust: 0.1

title:veracode-container-security-finding-parserurl:https://github.com/vincent-deng/veracode-container-security-finding-parser

Trust: 0.1

sources: VULMON: CVE-2016-6816 // JVNDB: JVNDB-2016-007656 // CNNVD: CNNVD-201611-610

EXTERNAL IDS

db:NVDid:CVE-2016-6816

Trust: 3.4

db:BIDid:94461

Trust: 2.0

db:SECTRACKid:1037332

Trust: 1.7

db:EXPLOIT-DBid:41783

Trust: 1.7

db:JVNid:JVNVU92250735

Trust: 0.8

db:JVNDBid:JVNDB-2016-007656

Trust: 0.8

db:PACKETSTORMid:159413

Trust: 0.6

db:AUSCERTid:ESB-2020.3415

Trust: 0.6

db:AUSCERTid:ESB-2019.1276

Trust: 0.6

db:CNNVDid:CNNVD-201611-610

Trust: 0.6

db:VULMONid:CVE-2016-6816

Trust: 0.1

db:PACKETSTORMid:141509

Trust: 0.1

db:PACKETSTORMid:140199

Trust: 0.1

db:PACKETSTORMid:140692

Trust: 0.1

db:PACKETSTORMid:140917

Trust: 0.1

db:PACKETSTORMid:141510

Trust: 0.1

db:PACKETSTORMid:140915

Trust: 0.1

sources: VULMON: CVE-2016-6816 // BID: 94461 // JVNDB: JVNDB-2016-007656 // PACKETSTORM: 141509 // PACKETSTORM: 140199 // PACKETSTORM: 140692 // PACKETSTORM: 140917 // PACKETSTORM: 141510 // PACKETSTORM: 140915 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

REFERENCES

url:http://www.securityfocus.com/bid/94461

Trust: 2.4

url:http://www.debian.org/security/2016/dsa-3738

Trust: 2.3

url:https://www.exploit-db.com/exploits/41783/

Trust: 1.8

url:https://access.redhat.com/errata/rhsa-2017:0456

Trust: 1.8

url:https://access.redhat.com/errata/rhsa-2017:0455

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2017-0247.html

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2017-0244.html

Trust: 1.8

url:https://tomcat.apache.org/security-9.html#fixed_in_apache_tomcat_9.0.0.m13

Trust: 1.7

url:https://tomcat.apache.org/security-8.html#fixed_in_apache_tomcat_8.5.8

Trust: 1.7

url:https://tomcat.apache.org/security-8.html#fixed_in_apache_tomcat_8.0.39

Trust: 1.7

url:https://tomcat.apache.org/security-7.html#fixed_in_apache_tomcat_7.0.73

Trust: 1.7

url:https://tomcat.apache.org/security-6.html#fixed_in_apache_tomcat_6.0.48

Trust: 1.7

url:http://www.securitytracker.com/id/1037332

Trust: 1.7

url:http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Trust: 1.7

url:https://access.redhat.com/errata/rhsa-2017:0935

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0527.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0457.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0250.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0246.html

Trust: 1.7

url:http://rhn.redhat.com/errata/rhsa-2017-0245.html

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20180607-0001/

Trust: 1.7

url:https://usn.ubuntu.com/4557-1/

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2016-6816

Trust: 1.4

url:https://nvd.nist.gov/vuln/detail/cve-2016-8735

Trust: 1.2

url:https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3cdev.tomcat.apache.org%3e

Trust: 1.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6816

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6817

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8735

Trust: 0.8

url:http://jvn.jp/vu/jvnvu92250735/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2016-6817

Trust: 0.8

url:https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3cdev.tomcat.apache.org%3e

Trust: 0.6

url:http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-107/index.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/79014

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3415/

Trust: 0.6

url:https://packetstormsecurity.com/files/159413/ubuntu-security-notice-usn-4557-1.html

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2016-6816

Trust: 0.5

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.4

url:https://access.redhat.com/security/team/contact/

Trust: 0.4

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.4

url:https://bugzilla.redhat.com/):

Trust: 0.4

url:https://qnalist.com/questions/7885204/security-cve-2016-6816-apache-tomcat-information-disclosure

Trust: 0.3

url:http://tomcat.apache.org/security-6.html

Trust: 0.3

url:http://tomcat.apache.org/security-7.html

Trust: 0.3

url:http://tomcat.apache.org/security-8.html

Trust: 0.3

url:http://tomcat.apache.org/security-9.html

Trust: 0.3

url:http://tomcat.apache.org/

Trust: 0.3

url:http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Trust: 0.3

url:https://www.oracle.com/technetwork/topics/security/bulletinjan2017-3431551.html

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6796

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6794

Trust: 0.3

url:https://access.redhat.com/articles/11258

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-8745

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-6797

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-0762

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-5018

Trust: 0.3

url:https://access.redhat.com/security/team/key/

Trust: 0.3

url:https://issues.jboss.org/):

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-6325

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-6325

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-8735

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-1240

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-8745

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-5018

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-6797

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-6796

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-3092

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-3092

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1240

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-0762

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-6794

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-9775

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-9774

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-8627

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-7061

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-8656

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-8656

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-7061

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2016-8627

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2017:0527

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://usn.ubuntu.com/3177-2/

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:http://www.ubuntu.com/usn/usn-3177-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/tomcat6/6.0.35-1ubuntu3.9

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/tomcat8/8.0.37-1ubuntu0.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-5388

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.3

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/tomcat7/7.0.52-1ubuntu0.8

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/jboss_enterprise_application_platform/

Trust: 0.1

url:https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=appplatform&downloadtype=securitypatches&version=6.4

Trust: 0.1

sources: VULMON: CVE-2016-6816 // BID: 94461 // JVNDB: JVNDB-2016-007656 // PACKETSTORM: 141509 // PACKETSTORM: 140199 // PACKETSTORM: 140692 // PACKETSTORM: 140917 // PACKETSTORM: 141510 // PACKETSTORM: 140915 // CNNVD: CNNVD-201611-610 // NVD: CVE-2016-6816

CREDITS

Ubuntu

Trust: 0.7

sources: PACKETSTORM: 140692 // CNNVD: CNNVD-201611-610

SOURCES

db:VULMONid:CVE-2016-6816
db:BIDid:94461
db:JVNDBid:JVNDB-2016-007656
db:PACKETSTORMid:141509
db:PACKETSTORMid:140199
db:PACKETSTORMid:140692
db:PACKETSTORMid:140917
db:PACKETSTORMid:141510
db:PACKETSTORMid:140915
db:CNNVDid:CNNVD-201611-610
db:NVDid:CVE-2016-6816

LAST UPDATE DATE

2024-11-06T22:24:47.337000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2016-6816date:2023-12-08T00:00:00
db:BIDid:94461date:2017-05-23T16:27:00
db:JVNDBid:JVNDB-2016-007656date:2019-04-12T00:00:00
db:CNNVDid:CNNVD-201611-610date:2020-10-22T00:00:00
db:NVDid:CVE-2016-6816date:2023-12-08T16:41:18.860

SOURCES RELEASE DATE

db:VULMONid:CVE-2016-6816date:2017-03-20T00:00:00
db:BIDid:94461date:2016-11-22T00:00:00
db:JVNDBid:JVNDB-2016-007656date:2017-03-09T00:00:00
db:PACKETSTORMid:141509date:2017-03-08T00:54:47
db:PACKETSTORMid:140199date:2016-12-18T13:55:00
db:PACKETSTORMid:140692date:2017-01-24T01:06:55
db:PACKETSTORMid:140917date:2017-02-03T15:54:17
db:PACKETSTORMid:141510date:2017-03-08T00:55:08
db:PACKETSTORMid:140915date:2017-02-03T15:54:03
db:CNNVDid:CNNVD-201611-610date:2016-11-22T00:00:00
db:NVDid:CVE-2016-6816date:2017-03-20T18:59:00.173