The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0455 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache     Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3,     and includes enhancements.

    Security Fix(es):

    * It was reported that the Tomcat init script performed unsafe file handling, which could result in local     privilege escalation. (CVE-2016-1240)

    * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group. A member of the group or a malicious web     application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

    * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427.
    JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a     Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this     flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)

    * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of     the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file     if the boundary was the typical tens of bytes long. (CVE-2016-3092)

    * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This     could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a     different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the     attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests     other then their own. (CVE-2016-6816)

    * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to     the current Processor object being added to the Processor cache multiple times allowing information     leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

    * The Realm implementations did not process the supplied password if the supplied user name did not exist.
    This made a timing attack possible to determine valid user names. Note that the default configuration     includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)

    * It was discovered that a malicious web application could bypass a configured SecurityManager via a     Tomcat utility method that was accessible to web applications. (CVE-2016-5018)

    * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature     for configuration files could be used by a malicious web application to bypass the SecurityManager and     read system properties that should not be visible. (CVE-2016-6794)

    * It was discovered that a malicious web application could bypass a configured SecurityManager via     manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

    * It was discovered that it was possible for a web application to access any global JNDI resource whether     an explicit ResourceLink had been configured or not. (CVE-2016-6797)

    The CVE-2016-6325 issue was discovered by Red Hat Product Security.

    Enhancement(s):

    This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 6.
    These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server.
    (JIRA#JWS-267)

    Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this     enhancement.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for tomcat6 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not limited to, session ID and the response body.

In addition this update also addresses a regression when running Tomcat 7 with SecurityManager enabled due to an incomplete fix for CVE-2016-6816.

For Debian 7 'Wheezy', these problems have been fixed in version 7.0.28-4+deb7u9.

We recommend that you upgrade your tomcat7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-8745

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1603:01 advisory.

    Tomcat is the servlet container that is used in the official Reference     Implementation for the Java Servlet and JavaServer Pages technologies.
    The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended     to be a collaboration of the best-of-breed developers from around the world.
    Security issues fixed with this release:
    CVE-2016-6816     The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6,     8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed     the HTTP request line permitted invalid characters. This could be     exploited, in conjunction with a proxy that also permitted the invalid     characters but with a different interpretation, to inject data into     the HTTP response. By manipulating the HTTP response the attacker     could poison a web-cache, perform an XSS attack and/or obtain     sensitive information from requests other then their own.
    CVE-2016-8745
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for tomcat6 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0935 advisory.

    - Resolves: rhbz#1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was discovered that the code that parsed the HTTP     request line permitted invalid characters. This could be     exploited, in conjunction with a proxy that also     permitted the invalid characters but with a different     interpretation, to inject data into the HTTP response.
    By manipulating the HTTP response the attacker could     poison a web-cache, perform an XSS attack, or obtain     sensitive information from requests other then their     own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

  - A bug was discovered in the error handling of the send     file code for the NIO HTTP connector. This led to the     current Processor object being added to the Processor     cache multiple times allowing information leakage     between requests including, and not limited to, session     ID and the response body. (CVE-2016-8745)

An update is now available for Red Hat JBoss Web Server 3 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements.

Security Fix(es) :

* It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation.
(CVE-2016-1240)

* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

* The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735)

* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.
(CVE-2016-3092)

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

* The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762)

* It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018)

* It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794)

* It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796)

* It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797)

The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Enhancement(s) :

* This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-268)

It was discovered that the code that parsed the HTTP request line permitted

invalid characters. This could be exploited, in conjunction with a proxy that

also permitted the invalid characters but with a different interpretation, to

inject data into the HTTP response. By manipulating the HTTP response the

attacker could poison a web-cache, perform an XSS attack, or obtain sensitive

information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when

request contains characters that are not permitted by the HTTP specification to

appear not encoded, even though they were previously accepted. The newly

introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow

can be used to configure Tomcat to accept curly braces ({ and }) and the pipe

symbol (|) in not encoded form, as these are often used in URLs without being

properly encoded.

  - A bug was discovered in the error handling of the send     file code for the NIO

HTTP connector. This led to the current Processor object being added to the

Processor cache multiple times allowing information leakage between requests

including, and not limited to, session ID and the response body.
(CVE-2016-8745)

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to     9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the     current Processor object being added to the Processor cache multiple times. This in turn meant that the     same Processor could be used for concurrent requests. Sharing a Processor can result in information     leakage between requests including, not not limited to, session ID and the response body. The bug was     first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards     made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring     introduced the bug but further investigation has shown that the bug is present in all currently supported     Tomcat versions. (CVE-2016-8745)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded.

* A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the code that parsed the HTTP     request line permitted invalid characters. This could     be exploited, in conjunction with a proxy that also     permitted the invalid characters but with a different     interpretation, to inject data into the HTTP response.
    By manipulating the HTTP response the attacker could     poison a web-cache, perform an XSS attack, or obtain     sensitive information from requests other then their     own. (CVE-2016-6816)

  - A bug was discovered in the error handling of the send     file code for the NIO HTTP connector. This led to the     current Processor object being added to the Processor     cache multiple times allowing information leakage     between requests including, and not limited to, session     ID and the response body. (CVE-2016-8745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 8.0.41. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.0.41_security-8 advisory.

  - A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to     9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the     current Processor object being added to the Processor cache multiple times. This in turn meant that the     same Processor could be used for concurrent requests. Sharing a Processor can result in information     leakage between requests including, not not limited to, session ID and the response body. The bug was     first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards     made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring     introduced the bug but further investigation has shown that the bug is present in all currently supported     Tomcat versions. (CVE-2016-8745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	2017/3/8	2024/11/4	critical
101438	Virtuozzo 6 : tomcat6 / tomcat6-admin-webapps / etc (VZLSA-2017-0527)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
96396	Debian DLA-779-1 : tomcat7 security update	Nessus	Debian Local Security Checks	2017/1/11	2026/1/6	high
97337	Fedora 25 : 1:tomcat (2017-376ae2b92c)	Nessus	Fedora Local Security Checks	2017/2/23	2025/12/31	high
289299	MiracleLinux 7 : tomcat-7.0.69-11.el7 (AXSA:2017-1603:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
97795	CentOS 6 : tomcat6 (CESA-2017:0527)	Nessus	CentOS Local Security Checks	2017/3/20	2025/12/29	high
99334	Oracle Linux 7 : tomcat (ELSA-2017-0935)	Nessus	Oracle Linux Local Security Checks	2017/4/13	2024/10/23	high
99353	Scientific Linux Security Update : tomcat on SL7.x (noarch) (20170412)	Nessus	Scientific Linux Local Security Checks	2017/4/13	2025/12/25	high
97596	RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)	Nessus	Red Hat Local Security Checks	2017/3/8	2023/5/14	critical
99037	Amazon Linux AMI : tomcat6 (ALAS-2017-810)	Nessus	Amazon Linux Local Security Checks	2017/3/30	2025/12/29	high
99384	CentOS 7 : tomcat (CESA-2017:0935)	Nessus	CentOS Local Security Checks	2017/4/14	2025/12/25	high
96344	Debian DSA-3754-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	2017/1/10	2026/1/6	high
246448	Linux Distros Unpatched Vulnerability : CVE-2016-8745	Nessus	Misc.	2025/8/9	2026/6/3	high
101450	Virtuozzo 7 : tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (VZLSA-2017-0935)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
99947	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1081)	Nessus	Huawei Local Security Checks	2017/5/3	2025/12/22	high
97481	Fedora 24 : 1:tomcat (2017-19c5440abe)	Nessus	Fedora Local Security Checks	2017/3/2	2025/12/31	high
197846	Apache Tomcat 8.0.0.RC1 < 8.0.41	Nessus	Web Servers	2024/5/23	2024/5/23	high

检测

插件搜索

critical

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high