The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

vulnerability alert CVE-2017-5648

Apache Tomcat: privilege escalation

Synthesis of the vulnerability

A local attacker can tamper with the data exchanged by applications hosted in one instance of Apache Tomcat.
Impacted products: Tomcat, Debian, Fedora, Snap Creator Framework, openSUSE Leap, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Creation date: 11/04/2017.
Identifiers: CERTFR-2017-AVI-116, CVE-2017-5648, DLA-924-1, DLA-924-2, DSA-3842-1, DSA-3843-1, FEDORA-2017-5261ba4605, FEDORA-2017-d5aa7c77d6, NTAP-20180605-0001, NTAP-20180607-0001, NTAP-20180607-0002, NTAP-20180614-0001, openSUSE-SU-2017:1292-1, RHSA-2017:1801-01, RHSA-2017:1802-01, RHSA-2017:1809-01, SUSE-SU-2017:1229-1, SUSE-SU-2017:1382-1, SUSE-SU-2017:1660-1, USN-3519-1, VIGILANCE-VUL-22401.

Description of the vulnerability

The Apache Tomcat is a web application server.

It may host several applications which must be isolated. However, an application can get handle objets to requests and responses for other applications, and so read their request or modify their response body.

A local attacker can therefore tamper with the data exchanged by applications hosted in one instance of Apache Tomcat.
Complete Vigil@nce bulletin.... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides an applications vulnerabilities database. Each administrator can customize the list of products for which he wants to receive vulnerability alerts. The technology watch team tracks security threats targeting the computer system. The Vigil@nce vulnerability database contains several thousand vulnerabilities.