Description
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | tomcat +9 | 7.0.54-8.el7_2 | RHSA-2016:2046 |
| RHEL 6 | tomcat6 +8 | 6.0.24-98.el6_8 | RHSA-2016:2045 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | hibernate4-eap6 +4 | 4.2.23-1.Final_redhat_1.1.ep6.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | jbcs-httpd24-apache-commons-daemon | 1.0.15-1.redhat_2.1.jbcs.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.0.15-17.redhat_2.jbcs.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | jbcs-httpd24-runtime | 1-3.jbcs.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | mod_cluster +2 | 1.3.5-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-9.redhat_9.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat-vault | 1.0.8-9.Final_redhat_2.1.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-16.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-17.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
Advisories 4
- RHSA-2016:2045 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2017:0456 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2017:0455 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:2046 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 93478 vdb-entry
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- RHSA-2016:2045 vendor-advisory
- RHSA-2016:2046 vendor-advisory
- RHSA-2017:0457 vendor-advisory
- RHSA-2017:0455 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1367447
- RHSA-2017:0456 vendor-advisory