Lucene search

K
nessusThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.ALA_ALAS-2017-810.NASL
HistoryMar 30, 2017 - 12:00 a.m.

Amazon Linux AMI : tomcat6 (ALAS-2017-810)

2017-03-3000:00:00
This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
131

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

79.4%

It was discovered that the code that parsed the HTTP request line permitted

invalid characters. This could be exploited, in conjunction with a proxy that

also permitted the invalid characters but with a different interpretation, to

inject data into the HTTP response. By manipulating the HTTP response the

attacker could poison a web-cache, perform an XSS attack, or obtain sensitive

information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when

request contains characters that are not permitted by the HTTP specification to

appear not encoded, even though they were previously accepted. The newly

introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow

can be used to configure Tomcat to accept curly braces ({ and }) and the pipe

symbol (|) in not encoded form, as these are often used in URLs without being

properly encoded.

  • A bug was discovered in the error handling of the send file code for the NIO

HTTP connector. This led to the current Processor object being added to the

Processor cache multiple times allowing information leakage between requests

including, and not limited to, session ID and the response body.
(CVE-2016-8745)

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux AMI Security Advisory ALAS-2017-810.
#

include("compat.inc");

if (description)
{
  script_id(99037);
  script_version("3.7");
  script_cvs_date("Date: 2019/04/10 16:10:16");

  script_cve_id("CVE-2016-6816", "CVE-2016-8745");
  script_xref(name:"ALAS", value:"2017-810");
  script_xref(name:"RHSA", value:"2017:0527");

  script_name(english:"Amazon Linux AMI : tomcat6 (ALAS-2017-810)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Amazon Linux AMI host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that the code that parsed the HTTP request line
permitted

invalid characters. This could be exploited, in conjunction with a
proxy that

also permitted the invalid characters but with a different
interpretation, to

inject data into the HTTP response. By manipulating the HTTP response
the

attacker could poison a web-cache, perform an XSS attack, or obtain
sensitive

information from requests other then their own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request
error when

request contains characters that are not permitted by the HTTP
specification to

appear not encoded, even though they were previously accepted. The
newly

introduced system property
tomcat.util.http.parser.HttpParser.requestTargetAllow

can be used to configure Tomcat to accept curly braces ({ and }) and
the pipe

symbol (|) in not encoded form, as these are often used in URLs
without being

properly encoded.

  - A bug was discovered in the error handling of the send
    file code for the NIO

HTTP connector. This led to the current Processor object being added
to the

Processor cache multiple times allowing information leakage between
requests

including, and not limited to, session ID and the response body.
(CVE-2016-8745)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/ALAS-2017-810.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Run 'yum update tomcat6' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-admin-webapps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-docs-webapp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-el-2.1-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-javadoc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-jsp-2.1-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-lib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-servlet-2.5-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat6-webapps");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/03/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/30");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "A")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"ALA", reference:"tomcat6-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-admin-webapps-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-docs-webapp-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-el-2.1-api-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-javadoc-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-jsp-2.1-api-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-lib-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-servlet-2.5-api-6.0.51-1.10.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"tomcat6-webapps-6.0.51-1.10.amzn1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tomcat6 / tomcat6-admin-webapps / tomcat6-docs-webapp / etc");
}
VendorProductVersionCPE
amazonlinuxtomcat6p-cpe:/a:amazon:linux:tomcat6
amazonlinuxtomcat6-admin-webappsp-cpe:/a:amazon:linux:tomcat6-admin-webapps
amazonlinuxtomcat6-docs-webappp-cpe:/a:amazon:linux:tomcat6-docs-webapp
amazonlinuxtomcat6-el-2.1-apip-cpe:/a:amazon:linux:tomcat6-el-2.1-api
amazonlinuxtomcat6-javadocp-cpe:/a:amazon:linux:tomcat6-javadoc
amazonlinuxtomcat6-jsp-2.1-apip-cpe:/a:amazon:linux:tomcat6-jsp-2.1-api
amazonlinuxtomcat6-libp-cpe:/a:amazon:linux:tomcat6-lib
amazonlinuxtomcat6-servlet-2.5-apip-cpe:/a:amazon:linux:tomcat6-servlet-2.5-api
amazonlinuxtomcat6-webappsp-cpe:/a:amazon:linux:tomcat6-webapps
amazonlinuxcpe:/o:amazon:linux

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

79.4%