Tomcat 升级

版本信息

当前环境中用的是 6.0.47

发现漏洞

Apache Tomcat 安全限制绕过漏洞(CVE-2016-8735)
Apache Tomcat 安全漏洞（CVE-2017-5647）
Apache Tomcat信息泄露漏洞(CVE-2016-8745)
Apache Tomcat 安全限制绕过漏洞(CVE-2016-6816)

漏洞信息

CVE-2017-5647

CVE-2017-5647 Apache Tomcat Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M18
Apache Tomcat 8.5.0 to 8.5.12
Apache Tomcat 8.0.0.RC1 to 8.0.42
Apache Tomcat 7.0.0 to 7.0.76
Apache Tomcat 6.0.0 to 6.0.52

Description
A bug in the handling of the pipelined requests when send file was used
resulted in the pipelined request being lost when send file processing
of the previous request completed. This could result in responses
appearing to be sent for the wrong request. For example, a user agent
that sent requests A, B and C could see the correct response for request
A, the response for request C for request B and no response for request C.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:

Switch to the BIO HTTP where available
Disable send file
Upgrade to Apache Tomcat 9.0.0.M19 or later
Upgrade to Apache Tomcat 8.5.13 or later
Upgrade to Apache Tomcat 8.0.43 or later
Upgrade to Apache Tomcat 7.0.77 or later
Upgrade to Apache Tomcat 6.0.53 or later

Credit:
This issue was identified by the Tomcat security team.

History:
2017-04-10 Original advisory

References:
[1] http://tomcat.apache.org/security-9.html
[2] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html
[4] http://tomcat.apache.org/security-6.html

CVE-2016-8735

该漏洞与之前Oracle发布的mxRemoteLifecycleListener反序列化漏洞（CVE-2016-3427）相关，是由于使用了JmxRemoteLifecycleListener的监听功能所导致。而在Oracle官方发布修复后，Tomcat未能及时修复更新而导致的远程代码执行。

该漏洞所造成的最根本原因是Tomcat在配置JMX做监控时使用了JmxRemoteLifecycleListener的方法。

漏洞影响版本：
ApacheTomcat 9.0.0.M1 到9.0.0.M11
ApacheTomcat 8.5.0 到8.5.6
ApacheTomcat 8.0.0.RC1 到8.0.38
ApacheTomcat 7.0.0 到7.0.72
ApacheTomcat 6.0.0 到6.0.47

漏洞利用条件：
外部需要开启JmxRemoteLifecycleListener监听的10001和10002端口，来实现远程代码执行。

CVE-2016-6816

Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability

Bugtraq ID: 94461
Class: Input Validation Error
CVE: CVE-2016-6816
Remote: Yes
Local: No
Published: Nov 22 2016 12:00AM
Updated: May 23 2017 04:27PM
Credit: Regis Leroy from Makina Corpus.
Vulnerable: Redhat Enterprise Linux Workstation Optional 7
Redhat Enterprise Linux Workstation Optional 6
Redhat Enterprise Linux Workstation 7
Redhat Enterprise Linux Workstation 6
Redhat Enterprise Linux Server Optional 7
Redhat Enterprise Linux Server Optional 6
Redhat Enterprise Linux Server 7
Redhat Enterprise Linux Server 6
Redhat Enterprise Linux HPC Node Optional 6
Redhat Enterprise Linux Desktop Optional 6
Redhat Enterprise Linux ComputeNode Optional 7
Redhat Enterprise Linux ComputeNode 7
Redhat Enterprise Linux Client Optional 7
Redhat Enterprise Linux 7 Client
Oracle Solaris 11.3
Oracle Solaris 10
Oracle Secure Global Desktop 5.3
Oracle Secure Global Desktop 5.2
Oracle Secure Global Desktop 4.71
Oracle Enterprise Linux 7
CentOS CentOS 7
Apache Tomcat 8.5.5
Apache Tomcat 8.5.4
Apache Tomcat 8.0.38
Apache Tomcat 8.0.37
Apache Tomcat 8.0.36
Apache Tomcat 8.0.35
Apache Tomcat 8.0.34
Apache Tomcat 8.0.33
Apache Tomcat 8.0.30
Apache Tomcat 8.0.27
Apache Tomcat 8.0.17
Apache Tomcat 8.0.15
Apache Tomcat 8.0.9
Apache Tomcat 8.0.8
Apache Tomcat 8.0.5
Apache Tomcat 8.0.3
Apache Tomcat 8.0.1
Apache Tomcat 7.0.72
Apache Tomcat 7.0.70
Apache Tomcat 7.0.69
Apache Tomcat 7.0.67
Apache Tomcat 7.0.65
Apache Tomcat 7.0.59
Apache Tomcat 7.0.57
Apache Tomcat 7.0.54
Apache Tomcat 7.0.53
Apache Tomcat 7.0.50
Apache Tomcat 7.0.33
Apache Tomcat 7.0.32
Apache Tomcat 7.0.31
Apache Tomcat 7.0.30
Apache Tomcat 7.0.29
Apache Tomcat 7.0.28
Apache Tomcat 7.0.27
Apache Tomcat 7.0.26
Apache Tomcat 7.0.25
Apache Tomcat 7.0.24
Apache Tomcat 7.0.23
Apache Tomcat 7.0.16
Apache Tomcat 7.0.15
Apache Tomcat 7.0.14
Apache Tomcat 7.0.13
Apache Tomcat 7.0.12
Apache Tomcat 7.0.9
Apache Tomcat 7.0.8
Apache Tomcat 7.0.7
Apache Tomcat 7.0.6
Apache Tomcat 7.0.4
Apache Tomcat 7.0.3
Apache Tomcat 7.0.2
Apache Tomcat 7.0.1
Apache Tomcat 7.0
Apache Tomcat 6.0.47
Apache Tomcat 6.0.44
Apache Tomcat 6.0.43
Apache Tomcat 6.0.41
Apache Tomcat 6.0.37
Apache Tomcat 6.0.36
Apache Tomcat 6.0.35
Apache Tomcat 6.0.28
Apache Tomcat 6.0.27
Apache Tomcat 6.0.26
Apache Tomcat 6.0.25
Apache Tomcat 6.0.24
Apache Tomcat 6.0.20
Apache Tomcat 6.0.18
Apache Tomcat 6.0.17
Apache Tomcat 6.0.16
Apache Tomcat 6.0.15
Apache Tomcat 6.0.14
Apache Tomcat 6.0.13
Apache Tomcat 6.0.12
Apache Tomcat 6.0.11
Apache Tomcat 6.0.10
Apache Tomcat 6.0.9
Apache Tomcat 6.0.8
Apache Tomcat 6.0.7
Apache Tomcat 6.0.6
Apache Tomcat 6.0.5
Apache Tomcat 6.0.4
Apache Tomcat 6.0.3
Apache Tomcat 6.0.2
Apache Tomcat 6.0.1
Apache Tomcat 6.0
Apache Tomcat 9.0.0M8
Apache Tomcat 9.0.0M6
Apache Tomcat 9.0.0.M9
Apache Tomcat 9.0.0.M5
Apache Tomcat 9.0.0.M4
Apache Tomcat 9.0.0.M3
Apache Tomcat 9.0.0.M2
Apache Tomcat 9.0.0.M11
Apache Tomcat 9.0.0.M10
Apache Tomcat 9.0.0.M1
Apache Tomcat 8.5.3
Apache Tomcat 8.5.2
Apache Tomcat 8.5.0
Apache Tomcat 8.0.32
Apache Tomcat 8.0.0.RC1
Apache Tomcat 8.0.0-RC6
Apache Tomcat 8.0.0-RC5
Apache Tomcat 8.0.0-RC3
Apache Tomcat 8.0.0-RC10
Apache Tomcat 8.0.0 Rc1
Apache Tomcat 7.0.68
Apache Tomcat 7.0.55
Apache Tomcat 7.0.5
Apache Tomcat 7.0.49
Apache Tomcat 7.0.48
Apache Tomcat 7.0.47
Apache Tomcat 7.0.46
Apache Tomcat 7.0.45
Apache Tomcat 7.0.44
Apache Tomcat 7.0.43
Apache Tomcat 7.0.42
Apache Tomcat 7.0.41
Apache Tomcat 7.0.40
Apache Tomcat 7.0.39
Apache Tomcat 7.0.38
Apache Tomcat 7.0.37
Apache Tomcat 7.0.36
Apache Tomcat 7.0.35
Apache Tomcat 7.0.34
Apache Tomcat 7.0.22
Apache Tomcat 7.0.21
Apache Tomcat 7.0.20
Apache Tomcat 7.0.19
Apache Tomcat 7.0.18
Apache Tomcat 7.0.11
Apache Tomcat 7.0.10
Apache Tomcat 6.0.45
Apache Tomcat 6.0.42
Apache Tomcat 6.0.39
Apache Tomcat 6.0.33
Apache Tomcat 6.0.32
Apache Tomcat 6.0.31
Apache Tomcat 6.0.30
Apache Tomcat 6.0.29
Apache Tomcat 6.0.19
Not Vulnerable: Apache Tomcat 8.5.8
Apache Tomcat 8.0.39
Apache Tomcat 7.0.73
Apache Tomcat 6.0.48
Apache Tomcat 9.0.0.M13

CVE-2016-8745

Description
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

解决办法

根据漏洞描述及V8.5.37版本信息，将其升级至8.5.37即可

Apache Tomcat Versions

tomcat各版本信息对照。在升级时注意jdk及其他组件版本信息。
详见： http://tomcat.apache.org/whichversion.html

CVE-2016-6816、CVE-2016-8735、CVE-2016-8745、CVE-2017-5647相关推荐

2016学计算机软件,2016年夏季学期计算机(软件)学院学年论文字数、页数和格式要求.doc...
2016年夏季学期计算机(软件)学院学年论文字数.页数和格式要求 2013级学年论文字数及页数的要求: (1)学年论文的字数不少于3000字 (2)页数不超过10页 (3)文件名格式:13-专业-班级 ...
【Hadoop Summit Tokyo 2016】中型组织的数据基础设施架构：收集、存储和分析的技巧...
本讲义出自 Egor Pakhomov在Hadoop Summit Tokyo 2016上的演讲,主要分享了数据收集.存储和分析的技巧,介绍了为什么SQL如此的重要以及如何在Hadoop中使用SQL, ...
【CIPS 2016】(4-5章)语言认知模型、语言表示以及深度学习(研究进展、现状趋势)
CIPS 2016 笔记整理 <中文信息处理发展报告(2016)>是中国中文信息学会召集专家对本领域学科方向和前沿技术的一次梳理,官方定位是深度科普,旨在向政府.企业.媒体等对中文信息 ...
2016年1月12日微软将结束IE8、IE9和IE10的技术支持
2016年1月12日微软将结束IE8.IE9和IE10的技术支持,将推出最终补丁鼓励用户升级到最新的浏览器. 结束支持并不是说之后用户不能再使用,而是微软之后不再提供安全更新.兼容修复和技术支持,因此 ...
2016河北省职称计算机考试试题及答案,2016年最新河北省职称计算机考试试题及答案概要.doc...
2016年最新河北省职称计算机考试试题及答案概要下列关于个人计算机的叙述中,错误的是________. ???A．个人计算机的英文缩写是PC ???B．个人计算机又称为微机 ???C．世界上第一台计 ...
二维数组，锯齿数组和集合 C# 一维数组、二维数组（矩形数组）、交错数组（锯齿数组）的使用 C# 数组、多维数组（矩形数组）、锯齿数组（交叉数组）...
二维数组,锯齿数组和集合一.二维数组二维数组: 一维数组----豆角二维数组----表格定义: 1.一维数组: 数据类型[] 数组变量名 = new 数据类型[数组长度]; 数据类型[] 数组 ...
短视频抢了直播饭碗，花椒、映客们逆袭抖音、快手无门
根据CNNIC发布的第39次<中国互联网络发展状况统计报告>,2016年网络直播服务在资本力量的推动下持续发展.截至2016年12月,网络直播用户规模达到了3.44亿,占网民总体的47.1 ...
NLP-阅读理解：“阅读理解”综述（Machine Reading Comprehension, MRC）【完形填空、多项选择、抽取式（答案片段抽取）、生成式（自由作答）】《机器阅读理解数据集》
<原始论文:Neural Machine Reading Comprehension: Methods and Trends> 一.阅读理解概述所谓的机器阅读理解(Machine Rea ...
监测数据处理系统-自动导出监测日报表、周报表及月报表（基坑监测、地铁监测）
一.软件简介本系统主要用于工程监测(基坑监测.隧道监测.建筑物沉降观测等)数据处理,主要功能:1.各类监测数据录入.计算:2.施工工况信息录入汇总:3.巡视记录的录入.巡视报告导出:4.依据已录入的 ...
2022 ACM杰出会员揭榜：清华黄隆波、刘世霞，北大郝丹、刘譞哲等23位华人学者入选！...
来源:新智元 2022年度ACM杰出会员(Distinguished Member)名单公布! 本次评选设有三个奖项,分别表彰在计算机领域做出的教育贡献.工程贡献和科学贡献. 今年共有67名会员入选. ...

CVE-2016-6816、CVE-2016-8735、CVE-2016-8745、CVE-2017-5647