QwikSec

Security Database

CVE

CWE

Training

CVE-2016-5425

Published: Oct 13, 2016

Modified: Aug 6, 2024

PUBLISHED

Description

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vdb-entry

x_refsource_SECTRACK

vdb-entry

x_refsource_BID

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

x_refsource_CONFIRM

http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html

x_refsource_MISC

http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html

x_refsource_MISC

[oss-security] 20161010 CVE-2016-5425 - Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation (affecting CentOS, Fedora, OracleLinux, RedHat etc.)

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_REDHAT

exploit

x_refsource_EXPLOIT-DB

[activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar

mailing-list

x_refsource_MLIST

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.