Fluid Attacks Database

Description

The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel6	tomcat6	<0:6.0.24-55.el6_4	0:6.0.24-55.el6_4
rpm rhel5	tomcat5	<0:5.5.23-0jpp.40.el5_9	0:5.5.23-0jpp.40.el5_9

Aliases

1. CVE-2013-19762. NVD-2013-19763. OSV-2013-1976

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.