NVD

Id
17136  
Name
CVE-2016-0763  
Description
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-02-24  
Modified Date
2016-12-05  
Seq
2016-0763  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
95135 17136 CVE-2016-0763 FEDORA-2016-e6651efbaf  View
95136 17136 CVE-2016-0763 SUSE-SU-2016:0769  View
95137 17136 CVE-2016-0763 SUSE-SU-2016:0822  View
95138 17136 CVE-2016-0763 openSUSE-SU-2016:0865  View
95139 17136 CVE-2016-0763 RHSA-2016:1089  View
95140 17136 CVE-2016-0763 20160222 [SECURITY] CVE-2016-0763 Apache Tomcat Security Manager Bypass  View
95141 17136 CVE-2016-0763 http://svn.apache.org/viewvc?view=revision&revision=1725926  View
95142 17136 CVE-2016-0763 http://svn.apache.org/viewvc?view=revision&revision=1725929  View
95143 17136 CVE-2016-0763 http://svn.apache.org/viewvc?view=revision&revision=1725931  View
95144 17136 CVE-2016-0763 http://tomcat.apache.org/security-7.html  View
95145 17136 CVE-2016-0763 http://tomcat.apache.org/security-8.html  View
95146 17136 CVE-2016-0763 http://tomcat.apache.org/security-9.html  View
95147 17136 CVE-2016-0763 DSA-3530  View
95148 17136 CVE-2016-0763 DSA-3552  View
95149 17136 CVE-2016-0763 DSA-3609  View
95150 17136 CVE-2016-0763 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
95151 17136 CVE-2016-0763 83326  View
95152 17136 CVE-2016-0763 1035069  View
95153 17136 CVE-2016-0763 USN-3024-1  View
95154 17136 CVE-2016-0763 RHSA-2016:1087  View
95155 17136 CVE-2016-0763 RHSA-2016:1088  View
95156 17136 CVE-2016-0763 https://bto.bluecoat.com/security-advisory/sa118  View
95157 17136 CVE-2016-0763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
95158 17136 CVE-2016-0763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View
95159 17136 CVE-2016-0763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
775 JVNDB-2016-001548 Apache Tomcat の org/apache/naming/factory/ResourceLinkFactory.java の setGlobalContext メソッドにおける SecurityManager の制限を回避される脆弱性 Apache Tomcat の org/apache/naming/factory/ResourceLinkFactory.java の setGlobalContext メソッドは、ResourceLinkFactory.setGlobalContext の呼び出し元が許可されているかどうかを考慮しないため、SecurityManager の制限を回避され、任意のアプリケーションデータを読み書きされる、またはサービス運用妨害 (アプリケーションの中断) 状態にされる脆弱性が存在します。 CVE-2016-0763 86967 CVE-2016-0763 17136 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001548.html 2016-01-05 2016-12-05 View