CVE-2016-5018
published 2017-08-10CVE-2016-5018: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass…
PriorityP266critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EXPLOIT
EPSS
10.30%
95.7th percentile
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | 6.0.0 – 6.0.45 | — |
| apache | tomcat | 7.0.0 – 7.0.70 | — |
| apache | tomcat | 8.0 – 8.0.36 | — |
| apache | tomcat | 8.5.0 – 8.5.4 | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| oracle | tekelec_platform_distribution | 7.4.0 – 7.7.1 | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is exploited via the Tomcat `proprietaryEvaluate` / `IntrospectHelper` utility method accessible to web applications, allowing SecurityManager bypass. Monitor for web application calls to these internal Tomcat utility methods. ↗
- →The exploit is specifically titled around `proprietaryEvaluate` and `introspecthelper` — audit web application code and deployed WARs for references to these Tomcat-internal methods as indicators of attempted sandbox escape. ↗
- →Affected versions span a wide range; flag any Tomcat instance running 9.0.0.M1–9.0.0.M9, 8.5.0–8.5.4, 8.0.0.RC1–8.0.36, 7.0.0–7.0.70, or 6.0.0–6.0.45 as vulnerable to this SecurityManager bypass. ↗
- ·The fix was applied in two separate revision sets for 8.x; ensure both patch revisions (1754900/1760305 for 8.5.x and 1754901/1760307 for 8.0.x) are present, as a single patch set alone may be insufficient. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv9.1CRITICAL
vendor_apache9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu5.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
ghsa·2022-05-13
CVE-2016-5018 [CRITICAL] CWE-288 Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
OSV
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
osv·2022-05-13
CVE-2016-5018 [CRITICAL] Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
OSV
tomcat6 vulnerabilities
osv·2020-09-30·CVSS 5.9
CVE-2016-0762 [MEDIUM] tomcat6 vulnerabilities
tomcat6 vulnerabilities
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. (CVE-2016-5018)
It was discovered that Tomcat incorrectly controlled reading system
properties. A malicious application could possibly use this to bypass
Security Manager restrictions. (CVE-2016-6794)
It was discovered that Tomcat incorrectly controlled certain configuration
parameters. A malicious application could possibly use this to bypass
Security Manager restri
OSV
tomcat6, tomcat7 regression
osv·2017-02-02·CVSS 5.9
[MEDIUM] tomcat6, tomcat7 regression
tomcat6, tomcat7 regression
USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a
regression in environments where Tomcat is started with a security manager.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue only
applied to Ubuntu 12.04 LT
OSV
tomcat6, tomcat7, tomcat8 vulnerabilities
osv·2017-01-23·CVSS 5.9
CVE-2016-0762 [MEDIUM] tomcat6, tomcat7, tomcat8 vulnerabilities
tomcat6, tomcat7, tomcat8 vulnerabilities
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue only
applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-5018)
It was discovered that Tomcat did not protect applications from untrusted
data in the HTTP_PROXY environment variable. A remote attacker could
possibly use this issue t
OSV
CVE-2016-5018: In Apache Tomcat 9
osv·2016-10-28·CVSS 9.1
CVE-2016-5018 [CRITICAL] CVE-2016-5018: In Apache Tomcat 9
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2020-09-30·CVSS 5.9
CVE-2016-6797 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. (CVE-2016-5018)
It was discovered that Tomcat incorrectly controlled reading system
properties. A malicious application could possibly use this to bypass
Security Manager restrictions. (CVE-2016-6794)
It was discovered that Tomcat incorrectly controlled certain configuration
parameters. A malicious applica
Ubuntu
Tomcat regression
vendor_ubuntu·2017-02-02·CVSS 5.9
[MEDIUM] Tomcat regression
Title: Tomcat regression
Summary: USN-3177-1 introduced a regression in Tomcat.
USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a
regression in environments where Tomcat is started with a security manager.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager res
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2017-01-23·CVSS 5.9
CVE-2016-0762 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue only
applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-5018)
It was discovered that Tomcat did not protect applications from untrusted
data in the HTTP_PROXY environment variable. A rem
Red Hat
tomcat: security manager bypass via IntrospectHelper utility function
vendor_redhat·2016-10-27·CVSS 9.1
CVE-2016-5018 [CRITICAL] tomcat: security manager bypass via IntrospectHelper utility function
tomcat: security manager bypass via IntrospectHelper utility function
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Package: tomcat5 (Red Hat Enterprise Linux 5) - Will not fix
Package: tomcat6 (Red Hat Enterprise Linux 6) - Will not fix
Package: jbossweb (Red Hat JBoss BRMS 5) - Out of support scope
Package: jbossweb (Red Hat JBoss Data Grid 6) - Out of support scope
Package: jbossweb (Red Hat JBoss Data Virtualizat
Apache
Apache tomcat: CVE-2016-5018
vendor_apache·CVSS 9.1
CVE-2016-5018 [CRITICAL] Apache tomcat: CVE-2016-5018
Apache tomcat: CVE-2016-5018
A malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. This was fixed in revisions 1754900 and 1760305 for 8.5.x and revisions 1754901 and 1760307 for 8.0.x. This issue was discovered by Alvaro Munoz and Alexander Mirosh of the HP Enterprise Security Team and reported to the Apache Tomcat Security Team on 5 July 2016. It was made public on 27 October 2016. Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36 Low: Timing Attack
No detection rules found.
Bugzilla
CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws [epel-6]
bugzilla·2016-11-01·CVSS 5.9
CVE-2016-0762 [MEDIUM] CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws [epel-6]
CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created b
Bugzilla
CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function
bugzilla·2016-11-01·CVSS 9.1
CVE-2016-5018 [CRITICAL] CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function
CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function
The following flaw was found in Tomcat:
A malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Upstream patches:
6.0.47: https://svn.apache.org/viewvc?view=revision&revision=1754904
7.0.72: https://svn.apache.org/viewvc?view=revision&revision=1754902
8.5.5: https://svn.apache.org/viewvc?view=revision&revision=1754900
8.0.37: https://svn.apache.org/viewvc?view=revision&revision=1754901
External References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.
Bugzilla
CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws [fedora-all]
bugzilla·2016-11-01·CVSS 5.9
CVE-2016-0762 [MEDIUM] CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws [fedora-all]
CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0457.htmlhttp://rhn.redhat.com/errata/RHSA-2017-1551.htmlhttp://www.debian.org/security/2016/dsa-3720http://www.securityfocus.com/bid/93942http://www.securitytracker.com/id/1037142http://www.securitytracker.com/id/1038757https://access.redhat.com/errata/RHSA-2017:0455https://access.redhat.com/errata/RHSA-2017:0456https://access.redhat.com/errata/RHSA-2017:1548https://access.redhat.com/errata/RHSA-2017:1549https://access.redhat.com/errata/RHSA-2017:1550https://access.redhat.com/errata/RHSA-2017:1552https://access.redhat.com/errata/RHSA-2017:2247https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20180605-0001/https://usn.ubuntu.com/4557-1/https://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0457.htmlhttp://rhn.redhat.com/errata/RHSA-2017-1551.htmlhttp://www.debian.org/security/2016/dsa-3720http://www.securityfocus.com/bid/93942http://www.securitytracker.com/id/1037142http://www.securitytracker.com/id/1038757https://access.redhat.com/errata/RHSA-2017:0455https://access.redhat.com/errata/RHSA-2017:0456https://access.redhat.com/errata/RHSA-2017:1548https://access.redhat.com/errata/RHSA-2017:1549https://access.redhat.com/errata/RHSA-2017:1550https://access.redhat.com/errata/RHSA-2017:1552https://access.redhat.com/errata/RHSA-2017:2247https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20180605-0001/https://usn.ubuntu.com/4557-1/https://www.oracle.com/security-alerts/cpuoct2021.html
2017-08-10
Published