The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.
CVSS Details
- CVSS 3.1 Base Score: 7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-libUpgrade tomcat6-el-2.1-apiUpgrade tomcat5-jsp-2.0-apiUpgrade tomcat5-common-libUpgrade tomcat6-javadocUpgrade tomcat5-jsp-2.0-api-javadocUpgrade tomcat5-servlet-2.4-api-javadocUpgrade tomcat5-servlet-2.4-apiUpgrade tomcat6-docs-webappUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat5-jasper-javadocUpgrade tomcat6-webappsUpgrade tomcat5-jasperUpgrade tomcat5Upgrade tomcat5-server-libUpgrade tomcat5-webappsUpgrade tomcat6Upgrade tomcat6-admin-webappsUpgrade tomcat5-admin-webapps | Dec 1, 2016 | Jul 9, 2013 |
| Oracle_linux | — | Upgrade tomcat5-server-libUpgrade tomcat5-admin-webappsUpgrade tomcat5-jasperUpgrade tomcat5-jasper-javadocUpgrade tomcat5-servlet-2.4-apiUpgrade tomcat5-jsp-2.0-apiUpgrade tomcat5-jsp-2.0-api-javadocUpgrade tomcat5-servlet-2.4-api-javadocUpgrade tomcat5-webappsUpgrade tomcat5Upgrade tomcat5-common-lib | Oct 16, 2024 | Jul 9, 2013 |
| Suse | — | Upgrade tomcat6-admin-webappsUpgrade tomcat6-webappsUpgrade tomcat-admin-webappsUpgrade tomcat6-libUpgrade tomcat6Upgrade tomcat-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-el-2_2-apiUpgrade tomcatUpgrade tomcat6-javadocUpgrade tomcat-docs-webappUpgrade tomcat6-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-lib | Dec 12, 2013 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub