CVE-2016-6797 Incorrect Authorization in Apache Tomcat
A web application can access unauthorized global JNDI resources in Apache Tomcat due to insufficient access control checks in the ResourceLinkFactory implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6797?
CVE-2016-6797 is a high-severity missing authorization vulnerability in Apache Tomcat, published on 10 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
Weakness: CWE-863
Which versions are affected by CVE-2016-6797?
8 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 14 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat Maven | From 7.0.0 | 7.0.72 |
org.apache.tomcat:tomcat Maven | From 7.0.0 | 7.0.72 |
org.apache.tomcat:tomcat Maven | From 8.0.0 | 8.0.37 |
org.apache.tomcat:tomcat Maven | From 8.0.0 | 8.0.37 |
org.apache.tomcat:tomcat Maven | From 8.5.0 | 8.5.5 |
org.apache.tomcat:tomcat Maven | From 8.5.0 | 8.5.5 |
2 more packages
org.apache.tomcat:tomcat Maven | From 9.0.0.M1 | 9.0.0.M10 |
org.apache.tomcat:tomcat Maven | From 9.0.0.M1 | 9.0.0.M10 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Oncommand Insight, Netapp Oncommand Shift, Netapp Snap Creator Framework and 8 more.
How do I fix CVE-2016-6797?
Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 7.0.72, 8.0.37, 8.5.5 or 9.0.0.M10.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-6797 being exploited?
There is no known exploitation of CVE-2016-6797 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as GHSA-q6x7-f33r-3wxx, UBUNTU-CVE-2016-6797.