CVE-2016-8735 Apache Tomcat Remote Code Execution

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M11
Apache Tomcat 8.5.0 to 8.5.6
Apache Tomcat 8.0.0.RC1 to 8.0.38
Apache Tomcat 7.0.0 to 7.0.72
Apache Tomcat 6.0.0 to 6.0.47
Earlier, unsupported versions may also be affected.

The JmxRemoteLifecycleListener was not updated to take account of
Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using
this listener remained vulnerable to a similar remote code execution
vulnerability. This issue has been rated as important rather than
critical due to the small number of installations using this listener
and that it would be highly unusual for the JMX ports to be accessible
to an attacker even when the listener is used.

Users of affected versions should apply one of the following mitigations
- Upgrade to Apache Tomcat 9.0.0.M13 or later
  (Apache Tomcat 9.0.0.M12 has the fix but was not released)
- Upgrade to Apache Tomcat 8.5.8 or later
  (Apache Tomcat 8.5.7 has the fix but was not released)
- Upgrade to Apache Tomcat 8.0.39 or later
- Upgrade to Apache Tomcat 7.0.73 or later
- Upgrade to Apache Tomcat 6.0.48 or later

This issue was discovered by Pierre Ernst and reported responsibly to
the Apache Tomcat Security Team.


Reply via email to