CVE-2017-5664

Impact:
Important
Public Date:
2017-06-06
CWE:
CWE-266
Bugzilla:
1459158: CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page.

Find out more about CVE-2017-5664 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This flaw can be triggered for static error pages only if the readonly property for the DefaultServlet is set to false in the $CATALINA_HOME/conf/web.xml file. The default for readonly is true.

CVSS v3 metrics

CVSS3 Base Score 7.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Impact High
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Enterprise Application Platform 6.4 RHSA-2017:2633 2017-09-05
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server (jbossweb) RHSA-2017:2637 2017-09-05
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server (jbossweb) RHSA-2017:2636 2017-09-05
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server RHSA-2017:2493 2017-08-21
Red Hat Enterprise Linux 6 (tomcat6) RHSA-2017:3080 2017-10-30
Red Hat Enterprise Linux 7 (tomcat) RHSA-2017:1809 2017-07-27
Red Hat JBoss Web Server 3.1 RHSA-2017:1802 2017-07-25
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server RHSA-2017:2493 2017-08-21
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (jbossweb) RHSA-2017:2635 2017-09-05
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (jboss-ec2-eap) RHSA-2017:2638 2017-09-05
Red Hat JBoss Web Server 3.1 for RHEL 6 RHSA-2017:1801 2017-07-25
Red Hat JBoss Web Server 3.1 for RHEL 7 RHSA-2017:1801 2017-07-25
Red Hat JBoss Web Server 2.1 RHSA-2017:2494 2017-08-21

Affected Packages State

Platform Package State
Red Hat Software Collections for Red Hat Enterprise Linux rh-java-common-tomcat Not affected
Red Hat JBoss Portal Platform 6 jbossweb Affected
Red Hat JBoss Operations Network 3 jbossweb Will not fix
Red Hat JBoss Fuse Service Works 6 jbossweb Will not fix
Red Hat JBoss Fuse 6 tomcat7 Under investigation
Red Hat JBoss Fuse 6 tomcat8 Under investigation
Red Hat JBoss Fuse 6 jbossweb Under investigation
Red Hat JBoss EAP 5 jbossweb Will not fix
Red Hat JBoss Data Virtualization 6 jbossweb Not affected
Red Hat JBoss Data Grid 6 jbossweb Not affected

Mitigation

If it is necessary to have the DefaultServlet property readonly=false, use a jsp error page, for example Error404.jsp rather than a static html error page. Alternatively do not specify an error-page in the Deployment Descriptor and use a custom ErrorReportValve.

External References

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.