Vulnerability Description
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 6.0.0, <= 6.0.45 |
| Oracle | Tekelec Platform Distribution | >= 7.4.0, <= 7.7.1 |
| Debian | Debian Linux | 8.0 |
| Netapp | Oncommand Insight | - |
| Netapp | Oncommand Shift | - |
| Netapp | Snap Creator Framework | - |
| Canonical | Ubuntu Linux | 16.04 |
| Redhat | Jboss Enterprise Web Server | 3.0.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Eus | 7.4 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.4 |
| Redhat | Enterprise Linux Server Tus | 7.6 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2017-0457.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3720Third Party Advisory
- http://www.securityfocus.com/bid/93940Broken Link
- http://www.securitytracker.com/id/1037145Broken Link
- https://access.redhat.com/errata/RHSA-2017:0455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:0456Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2247Third Party Advisory
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e8
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbea
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f9
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77
FAQ
What is CVE-2016-6797?
CVE-2016-6797 is a vulnerability with a CVSS score of 7.5 (HIGH). The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JN...
How severe is CVE-2016-6797?
CVE-2016-6797 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6797?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat, Oracle Tekelec Platform Distribution, Debian Debian Linux, Netapp Oncommand Insight, Netapp Oncommand Shift.