The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2046 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf     writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat     could use this flaw to escalate their privileges. (CVE-2016-5425)

    * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group. A member of the group or a malicious web     application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

    * It was found that the expression language resolver evaluated expressions within a privileged code     section. A malicious web application could use this flaw to bypass security manager protections.
    (CVE-2014-7810)

    * It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use     this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a     malicious HTTP request. (CVE-2016-5388)

    * A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least     one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could     reuse a previously used session ID for further requests. (CVE-2015-5346)

    Red Hat would like to thank Dawid Golunski (http://legalhackers.com) for reporting CVE-2016-5425 and Scott     Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product     Security.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the Tomcat packages installed configuration file / usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-5425)

* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

* It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. (CVE-2014-7810)

* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)

* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)

Red Hat would like to thank Dawid Golunski (http://legalhackers.com) for reporting CVE-2016-5425 and Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Security Fix(es) :

  - It was discovered that the Tomcat packages installed     configuration file /usr/lib/tmpfiles.d/tomcat.conf     writeable to the tomcat group. A member of the group or     a malicious web application deployed on Tomcat could use     this flaw to escalate their privileges. (CVE-2016-5425)

  - It was discovered that the Tomcat packages installed     certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group.
    A member of the group or a malicious web application     deployed on Tomcat could use this flaw to escalate their     privileges. (CVE-2016-6325)

  - It was found that the expression language resolver     evaluated expressions within a privileged code section.
    A malicious web application could use this flaw to     bypass security manager protections. (CVE-2014-7810)

  - It was discovered that tomcat used the value of the     Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which     in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing HTTP     requests. A remote attacker could possibly use this flaw     to redirect HTTP requests performed by a CGI script to     an attacker-controlled proxy via a malicious HTTP     request. (CVE-2016-5388)

  - A session fixation flaw was found in the way Tomcat     recycled the requestedSessionSSL field. If at least one     web application was configured to use the SSL session ID     as the HTTP session ID, an attacker could reuse a     previously used session ID for further requests.
    (CVE-2015-5346)

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0455 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache     Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3,     and includes enhancements.

    Security Fix(es):

    * It was reported that the Tomcat init script performed unsafe file handling, which could result in local     privilege escalation. (CVE-2016-1240)

    * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group. A member of the group or a malicious web     application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

    * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427.
    JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a     Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this     flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)

    * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of     the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file     if the boundary was the typical tens of bytes long. (CVE-2016-3092)

    * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This     could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a     different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the     attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests     other then their own. (CVE-2016-6816)

    * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to     the current Processor object being added to the Processor cache multiple times allowing information     leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

    * The Realm implementations did not process the supplied password if the supplied user name did not exist.
    This made a timing attack possible to determine valid user names. Note that the default configuration     includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)

    * It was discovered that a malicious web application could bypass a configured SecurityManager via a     Tomcat utility method that was accessible to web applications. (CVE-2016-5018)

    * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature     for configuration files could be used by a malicious web application to bypass the SecurityManager and     read system properties that should not be visible. (CVE-2016-6794)

    * It was discovered that a malicious web application could bypass a configured SecurityManager via     manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

    * It was discovered that it was possible for a web application to access any global JNDI resource whether     an explicit ResourceLink had been configured or not. (CVE-2016-6797)

    The CVE-2016-6325 issue was discovered by Red Hat Product Security.

    Enhancement(s):

    This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 6.
    These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server.
    (JIRA#JWS-267)

    Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this     enhancement.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This updates includes a rebase from tomcat 8.0.36 up to 8.0.38 which resolves multiple CVEs and a problem that 8.0.37 introduces to freeipa :

  - rhbz#1375581 - CVE-2016-5388 Tomcat: CGI sets     environmental variable based on user supplied Proxy     request header

  - rhbz#1390532 - CVE-2016-0762 CVE-2016-5018 CVE-2016-6794     CVE-2016-6796 CVE-2016-6797 tomcat: various flaws

and includes two additional CVE fixes along with one bug fix :

  - rhbz#1383210 - CVE-2016-5425 tomcat: Local privilege     escalation via systemd-tmpfiles service

  - rhbz#1383216 - CVE-2016-6325 tomcat: tomcat writable     config files allow privilege escalation

  - rhbz#1370262 - catalina.out is no longer in use in the     main package, but still gets rotated

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

A malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018)

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.
Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
(CVE-2016-6794)

A malicious web application was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

The ResourceLinkFactory did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797)

An update is now available for Red Hat JBoss Web Server 3 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements.

Security Fix(es) :

* It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation.
(CVE-2016-1240)

* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

* The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)

* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.
(CVE-2016-3092)

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

* The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)

* It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018)

* It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794)

* It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

* It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797)

The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Enhancement(s) :

* This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-268)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-704:01 advisory.

    Tomcat is the servlet container that is used in the official Reference     Implementation for the Java Servlet and JavaServer Pages technologies.
    The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended     to be a collaboration of the best-of-breed developers from around the world.
    Security issues fixed with this release:
    CVE-2014-7810     The Expression Language (EL) implementation in Apache Tomcat 6.x     before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not     properly consider the possibility of an accessible interface     implemented by an inaccessible class, which allows attackers to bypass     a SecurityManager protection mechanism via a web application that     leverages use of incorrect privileges during EL evaluation.
    CVE-2015-5346     Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x     before 8.0.30, and 9.x before 9.0.0.M2, when different session     settings are used for deployments of multiple versions of the same web     application, might allow remote attackers to hijack web sessions by     leveraging use of a requestedSessionSSL field for an unintended     request, related to CoyoteAdapter.java and Request.java.
    CVE-2016-5388     Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows     RFC 3875 section 4.1.18 and therefore does not protect applications     from the presence of untrusted client data in the HTTP_PROXY     environment variable, which might allow remote attackers to redirect     an application's outbound HTTP traffic to an arbitrary proxy server     via a crafted Proxy header in an HTTP request, aka an httpoxy issue.
    NOTE: the vendor states A mitigation is planned for future releases     of Tomcat, tracked as CVE-2016-5388; in other words, this is not a     CVE ID for a vulnerability.
    CVE-2016-5425
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-6325
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was discovered that the Tomcat packages installed     certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group.
    A member of the group or a malicious web application     deployed on Tomcat could use this flaw to escalate their     privileges. (CVE-2016-6325)

  - It was found that several Tomcat session persistence     mechanisms could allow a remote, authenticated user to     bypass intended SecurityManager restrictions and execute     arbitrary code in a privileged context via a web     application that placed a crafted object in a session.
    (CVE-2016-0714)

  - It was discovered that tomcat used the value of the     Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which     in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing HTTP     requests. A remote attacker could possibly use this flaw     to redirect HTTP requests performed by a CGI script to     an attacker-controlled proxy via a malicious HTTP     request. (CVE-2016-5388)

  - A directory traversal flaw was found in Tomcat's     RequestUtil.java. A remote, authenticated user could use     this flaw to bypass intended SecurityManager     restrictions and list a parent directory via a '/..' in     a pathname used by a web application in a getResource,     getResourceAsStream, or getResourcePaths call, as     demonstrated by the $CATALINA_BASE/webapps directory.
    (CVE-2015-5174)

  - It was found that Tomcat could reveal the presence of a     directory even when that directory was protected by a     security constraint. A user could make a request to a     directory via a URL not ending with a slash and,     depending on whether Tomcat redirected that request,     could confirm whether that directory existed.
    (CVE-2015-5345)

  - It was found that Tomcat allowed the     StatusManagerServlet to be loaded by a web application     when a security manager was configured. This allowed a     web application to list all deployed web applications     and expose sensitive information such as session IDs.
    (CVE-2016-0706)

Bug Fix(es) :

  - Due to a bug in the tomcat6 spec file, the catalina.out     file's md5sum, size, and mtime attributes were compared     to the file's attributes at installation time. Because     these attributes change after the service is started,     the 'rpm -V' command previously failed. With this     update, the attributes mentioned above are ignored in     the RPM verification and the catalina.out file now     passes the verification check.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Expression Language (EL) implementation in Apache     Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x     before 8.0.16 does not properly consider the     possibility of an accessible interface implemented by     an inaccessible class, which allows attackers to bypass     a SecurityManager protection mechanism via a web     application that leverages use of incorrect privileges     during EL evaluation.(CVE-2014-7810)

  - Session fixation vulnerability in Apache Tomcat 7.x     before 7.0.66, 8.x before 8.0.30, and 9.x before     9.0.0.M2, when different session settings are used for     deployments of multiple versions of the same web     application, might allow remote attackers to hijack web     sessions by leveraging use of a requestedSessionSSL     field for an unintended request, related to     CoyoteAdapter.java and Request.java.(CVE-2015-5346)

  - Apache Tomcat through 8.5.4, when the CGI Servlet is     enabled, follows RFC 3875 section 4.1.18 and therefore     does not protect applications from the presence of     untrusted client data in the HTTP_PROXY environment     variable, which might allow remote attackers to     redirect an application's outbound HTTP traffic to an     arbitrary proxy server via a crafted Proxy header in an     HTTP request, aka an 'httpoxy' issue. NOTE: the vendor     states 'A mitigation is planned for future releases of     Tomcat, tracked as CVE-2016-5388' in other words, this     is not a CVE ID for a vulnerability.(CVE-2016-5388)

  - It was discovered that the Tomcat packages installed     configuration file /usr/lib/tmpfiles.d/tomcat.conf     writeable to the tomcat group. A member of the group or     a malicious web application deployed on Tomcat could     use this flaw to escalate their     privileges.(CVE-2016-5425)

  - It was discovered that the Tomcat packages installed     certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group.
    A member of the group or a malicious web application     deployed on Tomcat could use this flaw to escalate     their privileges.(CVE-2016-6325)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2     uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local     users to gain privileges by leveraging membership in the tomcat group. (CVE-2016-6325)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update for tomcat6 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)

* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)

* A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174)

* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)

* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured.
This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)

Red Hat would like to thank Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Bug Fix(es) :

* Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were compared to the file's attributes at installation time. Because these attributes change after the service is started, the 'rpm -V' command previously failed. With this update, the attributes mentioned above are ignored in the RPM verification and the catalina.out file now passes the verification check. (BZ#1357123)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-705:03 advisory.

    Tomcat is the servlet container that is used in the official Reference     Implementation for the Java Servlet and JavaServer Pages technologies.
    The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended     to be a collaboration of the best-of-breed developers from around the world.
    Security issues fixed with this release:
    CVE-2015-5174     Directory traversal vulnerability in RequestUtil.java in Apache Tomcat     6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows     remote authenticated users to bypass intended SecurityManager     restrictions and list a parent directory via a /.. (slash dot dot) in     a pathname used by a web application in a getResource,     getResourceAsStream, or getResourcePaths call, as demonstrated by the     $CATALINA_BASE/webapps directory.
    CVE-2015-5345     The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before     7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects     before considering security constraints and Filters, which allows     remote attackers to determine the existence of a directory via a URL     that lacks a trailing / (slash) character.
    CVE-2016-0706     Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31,     and 9.x before 9.0.0.M2 does not place     org.apache.catalina.manager.StatusManagerServlet on the     org/apache/catalina/core/RestrictedServlets.properties list, which     allows remote authenticated users to bypass intended SecurityManager     restrictions and read arbitrary HTTP requests, and consequently     discover session ID values, via a crafted web application.
    CVE-2016-0714     The session-persistence implementation in Apache Tomcat 6.x before     6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2     mishandles session attributes, which allows remote authenticated users     to bypass intended SecurityManager restrictions and execute arbitrary     code in a privileged context via a web application that places a     crafted object in a session.
    CVE-2016-5388     Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows     RFC 3875 section 4.1.18 and therefore does not protect applications     from the presence of untrusted client data in the HTTP_PROXY     environment variable, which might allow remote attackers to redirect     an application's outbound HTTP traffic to an arbitrary proxy server     via a crafted Proxy header in an HTTP request, aka an httpoxy issue.
    NOTE: the vendor states A mitigation is planned for future releases     of Tomcat, tracked as CVE-2016-5388; in other words, this is not a     CVE ID for a vulnerability.
    CVE-2016-6325
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were     compared to the file's attributes at installation time. Because these attributes change after the service     is started, the rpm -V command previously failed. With this update, the attributes mentioned above are     ignored in the RPM verification and the catalina.out file now passes the verification check.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2045 advisory.

    - Resolves: rhbz#1362210 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied     Proxy request header
    - Resolves: rhbz#1367051 CVE-2015-5174 URL Normalization issue
    - Resolves: rhbz#1367054 CVE-2016-0706 Security Manager bypass via StatusManagerServlet
    - Resolves: rhbz#1367058 CVE-2016-0714 Security Manager bypass via persistence mechanisms
    - Resolves: rhbz#1367054 CVE-2015-5345 Directory disclosure

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93951	RHEL 7 : tomcat (RHSA-2016:2046)	Nessus	Red Hat Local Security Checks	2016/10/11	2026/1/22	high
93966	CentOS 7 : tomcat (CESA-2016:2046) (httpoxy)	Nessus	CentOS Local Security Checks	2016/10/12	2026/1/22	high
94005	Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161010) (httpoxy)	Nessus	Scientific Linux Local Security Checks	2016/10/12	2026/1/22	high
112192	Apache ActiveMQ 5.x < 5.15.5 Multiple Vulnerabilities	Nessus	CGI abuses	2018/8/30	2024/6/6	critical
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	2017/3/8	2024/11/4	critical
94747	Fedora 23 : 1:tomcat (2016-4094bd4ad6) (httpoxy)	Nessus	Fedora Local Security Checks	2016/11/14	2026/1/19	critical
94748	Fedora 24 : 1:tomcat (2016-c1b01b9278) (httpoxy)	Nessus	Fedora Local Security Checks	2016/11/14	2026/1/19	critical
94684	Amazon Linux AMI : tomcat6 / tomcat7,tomcat8 (ALAS-2016-764)	Nessus	Amazon Linux Local Security Checks	2016/11/11	2026/1/19	critical
97596	RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)	Nessus	Red Hat Local Security Checks	2017/3/8	2023/5/14	critical
289327	MiracleLinux 7 : tomcat-7.0.54-8.el7 (AXSA:2016-704:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/10	high
94004	Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20161010) (httpoxy)	Nessus	Scientific Linux Local Security Checks	2016/10/12	2026/1/22	high
94997	Fedora 25 : 1:tomcat (2016-38e5b05260) (httpoxy)	Nessus	Fedora Local Security Checks	2016/11/21	2026/1/16	critical
99812	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2016-1049)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	high
219933	Linux Distros Unpatched Vulnerability : CVE-2016-6325	Nessus	Misc.	2025/3/4	2025/9/2	high
93965	CentOS 6 : tomcat6 (CESA-2016:2045) (httpoxy)	Nessus	CentOS Local Security Checks	2016/10/12	2026/1/22	high
289479	MiracleLinux 4 : tomcat6-6.0.24-98.AXS4 (AXSA:2016-705:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
93947	Oracle Linux 6 : tomcat6 (ELSA-2016-2045)	Nessus	Oracle Linux Local Security Checks	2016/10/11	2025/4/29	high

检测

插件搜索

high

high

high

critical

critical

critical

critical

critical

critical

high

high

critical

high

high

high

high

high