NVD

Id
17669  
Name
CVE-2016-1240  
Description
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2016-10-03  
Modified Date
2016-11-28  
Seq
2016-1240  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
97389 17669 CVE-2016-1240 http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html  View
97390 17669 CVE-2016-1240 DSA-3669  View
97391 17669 CVE-2016-1240 DSA-3670  View
97392 17669 CVE-2016-1240 20161001 CVE-2016-1240 - Tomcat packaging on Debian-based distros - Local Root Privilege Escalation  View
97393 17669 CVE-2016-1240 93263  View
97394 17669 CVE-2016-1240 1036845  View
97395 17669 CVE-2016-1240 USN-3081-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
4285 JVNDB-2016-005058 Debian jessie および Ubuntu 上で稼動する tomcat パッケージの Tomcat init スクリプトにおける root 権限を取得される脆弱性 Debian jessie および Ubuntu 上で稼動する tomcat パッケージにおける Tomcat init スクリプトには、root 権限を取得される脆弱性が存在します。 CVE-2016-1240 87746 CVE-2016-1240 17669 7.2 7.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005058.html 2016-09-15 2016-10-05 View