The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4557-1 advisory.

  - The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to     8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user     name did not exist. This made a timing attack possible to determine valid user names. Note that the     default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
    (CVE-2016-0762)

  - In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to     6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility     method that was accessible to web applications. (CVE-2016-5018)

  - When a SecurityManager is configured, a web application's ability to read system properties should be     controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to     8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files     could be used by a malicious web application to bypass the SecurityManager and read system properties that     should not be visible. (CVE-2016-6794)

  - A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to     8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via     manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

  - The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to     8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources     to those resources explicitly linked to the web application. Therefore, it was possible for a web     application to access any global JNDI resource whether an explicit ResourceLink had been configured or     not. (CVE-2016-6797)

  - The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and     6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited,     in conjunction with a proxy that also permitted the invalid characters but with a different     interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker     could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other     then their own. (CVE-2016-6816)

  - Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39,     8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can     reach JMX ports. The issue exists because this listener wasn't updated for consistency with the     CVE-2016-3427 Oracle patch that affected credential types. (CVE-2016-8735)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS : Tomcat vulnerabilities (USN-4557-1)

critical Nessus Plugin ID 141092

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Oct 21, 2023, 9:06 AM Detection Plugin Feed: 202310210906
Version 1.4 May 14, 2023, 12:09 PM CISA reference CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Plugin Feed: 202305141209
Version 1.3 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901