CVE-2016-9775 in Tomcat
Summary
by MITRE
The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package before 7.0.28-4+deb7u7 on Debian wheezy, before 7.0.56-3+deb8u6 on Debian jessie, before 7.0.52-1ubuntu0.8 on Ubuntu 14.04 LTS, and on Ubuntu 12.04 LTS, 16.04 LTS, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on Debian jessie, before 8.0.32-1ubuntu1.3 on Ubuntu 16.04 LTS, before 8.0.37-1ubuntu0.1 on Ubuntu 16.10, and before 8.0.38-2ubuntu1 on Ubuntu 17.04 might allow local users with access to the tomcat account to gain root privileges via a setgid program in the Catalina directory, as demonstrated by /etc/tomcat8/Catalina/attack.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2022
This vulnerability represents a critical privilege escalation flaw in the tomcat6, tomcat7, and tomcat8 packages across multiple Debian and Ubuntu distributions. The issue stems from the improper handling of the postrm script during package removal operations, which creates a security risk when the tomcat user has write access to the Catalina directory structure. The vulnerability specifically targets the setgid bit functionality that allows local users with tomcat account access to escalate their privileges to root level. The attack vector is demonstrated through the manipulation of setgid programs located within the Catalina directory, where the postrm script fails to properly clean or validate the environment during package removal processes.
The technical flaw manifests in the package management scripts that fail to adequately secure the Catalina directory structure during package deinstallation. When a malicious user with access to the tomcat account can place a setgid program in the Catalina directory, the postrm script does not properly handle the cleanup process, allowing the setgid program to maintain its privileged execution context. This creates a persistent backdoor mechanism that can be exploited by local users to gain root privileges. The vulnerability is particularly concerning because it leverages the legitimate package management process to create an unintended privilege escalation path. The flaw is categorized under CWE-276 as improper file permissions and CWE-269 as improper privilege management, both of which are fundamental security weaknesses in system administration.
The operational impact of this vulnerability is severe as it allows local privilege escalation attacks to be executed without requiring additional authentication or network access. An attacker who has gained access to the tomcat user account can exploit this vulnerability to gain root privileges, which provides complete control over the system. The attack requires minimal prerequisites since the tomcat user is typically a legitimate system user with access to the application directory. This vulnerability affects a wide range of server environments that rely on these tomcat packages for web application hosting, making it a significant concern for organizations running these specific versions. The vulnerability is particularly dangerous in multi-tenant environments where the tomcat user might have access to sensitive application data.
Mitigation strategies should focus on immediate package updates to the patched versions that address the postrm script handling issues. System administrators should ensure all affected tomcat packages are updated to the latest versions that include proper cleanup routines for the Catalina directory. The recommended approach includes implementing strict file permission controls on the Catalina directory and its contents, ensuring that the setgid bit is properly managed during package operations. Organizations should also conduct thorough security audits of their tomcat installations to identify any potential setgid programs that could be exploited. Additional protective measures include implementing monitoring for unauthorized modifications to the Catalina directory and applying the principle of least privilege to the tomcat user account. The ATT&CK framework categorizes this as privilege escalation through package management, specifically under T1068 which involves exploiting vulnerabilities in system processes. Organizations should also consider implementing containerization or virtualization strategies to isolate tomcat processes and limit the potential impact of such vulnerabilities.