The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0527 advisory.

    - Related: rhbz#1402664 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-     encoded characters
    - Related: rhbz#1402664 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816
    - Resolves: rhbz#1413589 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor     sharing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was discovered that the code that parsed the HTTP     request line permitted invalid characters. This could be     exploited, in conjunction with a proxy that also     permitted the invalid characters but with a different     interpretation, to inject data into the HTTP response.
    By manipulating the HTTP response the attacker could     poison a web-cache, perform an XSS attack, or obtain     sensitive information from requests other then their     own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

  - A bug was discovered in the error handling of the send     file code for the NIO HTTP connector. This led to the     current Processor object being added to the Processor     cache multiple times allowing information leakage     between requests including, and not limited to, session     ID and the response body. (CVE-2016-8745)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0935 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This     could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a     different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the     attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests     other then their own. (CVE-2016-6816)

    Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains     characters that are not permitted by the HTTP specification to appear not encoded, even though they were     previously accepted. The newly introduced system property     tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly     braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without     being properly encoded.

    * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to     the current Processor object being added to the Processor cache multiple times allowing information     leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the code that parsed the HTTP     request line permitted invalid characters. This could     be exploited, in conjunction with a proxy that also     permitted the invalid characters but with a different     interpretation, to inject data into the HTTP response.
    By manipulating the HTTP response the attacker could     poison a web-cache, perform an XSS attack, or obtain     sensitive information from requests other then their     own. (CVE-2016-6816)

  - A bug was discovered in the error handling of the send     file code for the NIO HTTP connector. This led to the     current Processor object being added to the Processor     cache multiple times allowing information leakage     between requests including, and not limited to, session     ID and the response body. (CVE-2016-8745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3177-1 advisory.

    It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username     didn't exist. A remote attacker could possibly use this issue to enumerate usernames. This issue only     applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)

    Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly limited use of a certain utility     method. A malicious application could possibly use this to bypass Security Manager restrictions. This     issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5018)

    It was discovered that Tomcat did not protect applications from untrusted data in the HTTP_PROXY     environment variable. A remote attacker could possibly use this issue to redirect outbound traffic to an     arbitrary proxy server. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04     LTS. (CVE-2016-5388)

    It was discovered that Tomcat incorrectly controlled reading system properties. A malicious application     could possibly use this to bypass Security Manager restrictions. This issue only applied to Ubuntu 12.04     LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6794)

    It was discovered that Tomcat incorrectly controlled certain configuration parameters. A malicious     application could possibly use this to bypass Security Manager restrictions. This issue only applied to     Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6796)

    It was discovered that Tomcat incorrectly limited access to global JNDI resources. A malicious application     could use this to access any global JNDI resource without an explicit ResourceLink. This issue only     applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6797)

    Regis Leroy discovered that Tomcat incorrectly filtered certain invalid characters from the HTTP request     line. A remote attacker could possibly use this issue to inject data into HTTP responses. (CVE-2016-6816)

    Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did not implement a recommended fix. A     remote attacker could possibly use this issue to execute arbitrary code. (CVE-2016-8735)

    It was discovered that Tomcat incorrectly handled error handling in the send file code. A remote attacker     could possibly use this issue to access information from other requests. (CVE-2016-8745)

    Paul Szabo discovered that the Tomcat package incorrectly handled upgrades and removals. A local attacker     could possibly use this issue to obtain root privileges. (CVE-2016-9774, CVE-2016-9775)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0455 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache     Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3,     and includes enhancements.

    Security Fix(es):

    * It was reported that the Tomcat init script performed unsafe file handling, which could result in local     privilege escalation. (CVE-2016-1240)

    * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group. A member of the group or a malicious web     application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

    * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427.
    JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a     Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this     flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)

    * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of     the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file     if the boundary was the typical tens of bytes long. (CVE-2016-3092)

    * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This     could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a     different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the     attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests     other then their own. (CVE-2016-6816)

    * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to     the current Processor object being added to the Processor cache multiple times allowing information     leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

    * The Realm implementations did not process the supplied password if the supplied user name did not exist.
    This made a timing attack possible to determine valid user names. Note that the default configuration     includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)

    * It was discovered that a malicious web application could bypass a configured SecurityManager via a     Tomcat utility method that was accessible to web applications. (CVE-2016-5018)

    * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature     for configuration files could be used by a malicious web application to bypass the SecurityManager and     read system properties that should not be visible. (CVE-2016-6794)

    * It was discovered that a malicious web application could bypass a configured SecurityManager via     manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

    * It was discovered that it was possible for a web application to access any global JNDI resource whether     an explicit ResourceLink had been configured or not. (CVE-2016-6797)

    The CVE-2016-6325 issue was discovered by Red Hat Product Security.

    Enhancement(s):

    This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 6.
    These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server.
    (JIRA#JWS-267)

    Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this     enhancement.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201705-09 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tomcat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       obtain sensitive information, bypass protection mechanisms and       authentication restrictions.
    A local attacker, who is a tomcat&rsquo;s system user or belongs to       tomcat&rsquo;s group, could potentially escalate privileges.
  Workaround :

    There is no known workaround at this time.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 8.0.41. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.0.41_security-8 advisory.

  - A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to     9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the     current Processor object being added to the Processor cache multiple times. This in turn meant that the     same Processor could be used for concurrent requests. Sharing a Processor can result in information     leakage between requests including, not not limited to, session ID and the response body. The bug was     first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards     made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring     introduced the bug but further investigation has shown that the bug is present in all currently supported     Tomcat versions. (CVE-2016-8745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-8745

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to     9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the     current Processor object being added to the Processor cache multiple times. This in turn meant that the     same Processor could be used for concurrent requests. Sharing a Processor can result in information     leakage between requests including, not not limited to, session ID and the response body. The bug was     first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards     made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring     introduced the bug but further investigation has shown that the bug is present in all currently supported     Tomcat versions. (CVE-2016-8745)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure.

It was discovered that the code that parsed the HTTP request line permitted

invalid characters. This could be exploited, in conjunction with a proxy that

also permitted the invalid characters but with a different interpretation, to

inject data into the HTTP response. By manipulating the HTTP response the

attacker could poison a web-cache, perform an XSS attack, or obtain sensitive

information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when

request contains characters that are not permitted by the HTTP specification to

appear not encoded, even though they were previously accepted. The newly

introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow

can be used to configure Tomcat to accept curly braces ({ and }) and the pipe

symbol (|) in not encoded form, as these are often used in URLs without being

properly encoded.

  - A bug was discovered in the error handling of the send     file code for the NIO

HTTP connector. This led to the current Processor object being added to the

Processor cache multiple times allowing information leakage between requests

including, and not limited to, session ID and the response body.
(CVE-2016-8745)

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97765	Oracle Linux 6 : tomcat6 (ELSA-2017-0527)	Nessus	Oracle Linux Local Security Checks	2017/3/16	2024/11/1	high
97770	Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20170315)	Nessus	Scientific Linux Local Security Checks	2017/3/16	2025/12/30	high
99348	RHEL 7 : tomcat (RHSA-2017:0935)	Nessus	Red Hat Local Security Checks	2017/4/13	2024/11/4	high
99948	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1082)	Nessus	Huawei Local Security Checks	2017/5/3	2025/12/22	high
96720	Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerabilities (USN-3177-1)	Nessus	Ubuntu Local Security Checks	2017/1/24	2024/8/27	critical
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	2017/3/8	2024/11/4	critical
100262	GLSA-201705-09 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/5/18	2025/12/18	critical
101450	Virtuozzo 7 : tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (VZLSA-2017-0935)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
197846	Apache Tomcat 8.0.0.RC1 < 8.0.41	Nessus	Web Servers	2024/5/23	2024/5/23	high
97481	Fedora 24 : 1:tomcat (2017-19c5440abe)	Nessus	Fedora Local Security Checks	2017/3/2	2025/12/31	high
99947	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1081)	Nessus	Huawei Local Security Checks	2017/5/3	2025/12/22	high
246448	Linux Distros Unpatched Vulnerability : CVE-2016-8745	Nessus	Misc.	2025/8/9	2025/8/9	high
96344	Debian DSA-3754-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	2017/1/10	2026/1/6	high
99037	Amazon Linux AMI : tomcat6 (ALAS-2017-810)	Nessus	Amazon Linux Local Security Checks	2017/3/30	2025/12/29	high
99384	CentOS 7 : tomcat (CESA-2017:0935)	Nessus	CentOS Local Security Checks	2017/4/14	2025/12/25	high

检测

插件搜索

high

high

high

high

critical

critical

critical

high

high

high

high

high

high

high

high