CVE-2016-6794

MEDIUM

Description

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

ID	Name	Product	Family	Severity
103030	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1192)	Nessus	Huawei Local Security Checks	medium
103029	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1191)	Nessus	Huawei Local Security Checks	medium
102756	CentOS 7 : tomcat (CESA-2017:2247)	Nessus	CentOS Local Security Checks	medium
102664	Scientific Linux Security Update : tomcat on SL7.x (noarch)	Nessus	Scientific Linux Local Security Checks	medium
102300	Oracle Linux 7 : tomcat (ELSA-2017-2247)	Nessus	Oracle Linux Local Security Checks	medium
102115	RHEL 7 : tomcat (RHSA-2017:2247)	Nessus	Red Hat Local Security Checks	medium
99930	Oracle Secure Global Desktop Multiple Vulnerabilities (April 2017 CPU) (SWEET32)	Nessus	Misc.	high
97596	RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)	Nessus	Red Hat Local Security Checks	high
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	high
96978	Ubuntu 12.04 LTS / 14.04 LTS : tomcat6, tomcat7 regression (USN-3177-2) (httpoxy)	Nessus	Ubuntu Local Security Checks	high
96720	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : tomcat6, tomcat7, tomcat8 vulnerabilities (USN-3177-1) (httpoxy)	Nessus	Ubuntu Local Security Checks	high
96366	FreeBSD : tomcat -- multiple vulnerabilities (3ae106e2-d521-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
95791	openSUSE Security Update : tomcat (openSUSE-2016-1456)	Nessus	SuSE Local Security Checks	high
95790	openSUSE Security Update : tomcat (openSUSE-2016-1455)	Nessus	SuSE Local Security Checks	high
95455	Debian DLA-729-1 : tomcat7 security update	Nessus	Debian Local Security Checks	high
95454	Debian DLA-728-1 : tomcat6 security update	Nessus	Debian Local Security Checks	high
95034	Debian DSA-3721-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	medium
95033	Debian DSA-3720-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	medium
94997	Fedora 25 : 1:tomcat (2016-38e5b05260) (httpoxy)	Nessus	Fedora Local Security Checks	high
94748	Fedora 24 : 1:tomcat (2016-c1b01b9278) (httpoxy)	Nessus	Fedora Local Security Checks	high
94747	Fedora 23 : 1:tomcat (2016-4094bd4ad6) (httpoxy)	Nessus	Fedora Local Security Checks	high
94684	Amazon Linux AMI : tomcat6 / tomcat7,tomcat8 (ALAS-2016-764)	Nessus	Amazon Linux Local Security Checks	high
94578	Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 / 8.5.x < 8.5.5 / 9.0.x < 9.0.0.M10 Multiple Vulnerabilities	Nessus	Web Servers	medium
9723	Apache Tomcat 6.x < 6.0.47 / 7.x < 7.0.72 / 8.x < 8.0.37 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
9721	Apache Tomcat 8.5.x < 8.5.5 / 9.x < 9.0.0.M10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

CVE-2016-6794

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0