Apache fixed an important RCE flaw in Tomcat application server

The Apache Software Foundation has released new versions of the Tomcat application server that address an important remote code execution vulnerability.

The new versions of the Tomcat application server address an important remote code execution vulnerability that could be exploited by a remote attacker to execute malicious code and take control of a vulnerable server.

The remote code execution vulnerability, tracked as CVE-2019-0232, resides in the Common Gateway Interface (CGI) Servlet when running on Windows with enableCmdLineArguments enabled. The flaw ties the way the Java Runtime Environment (JRE) passes command line arguments to Windows.

“When running on Windows with enableCmdLineArguments enabled, the CGI Servlet is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disabled by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability).” wrote Mark Thomas from Apache Foundation.

The vulnerability has been rated as only important because the CGI Servlet is disabled by default and its option enableCmdLineArguments is disabled by default in Tomcat 9.0.x.

To mitigate the RCE vulnerability, the CGI Servlet enableCmdLineArguments option will now be disabled by default in all versions of Apache Tomcat.

Technical details about the JRE behaviour were provided in a blog post published by Markus Wulftange.

Below the list of the affected versions of the Tomcat application server:

  • Apache Tomcat 9.0.0.M1 to 9.0.17
  • Apache Tomcat 8.5.0 to 8.5.39
  • Apache Tomcat 7.0.0 to 7.0.93

The following Tomcat versions are not affected by the flaw:

  • Apache Tomcat 9.0.18 and later
  • Apache Tomcat 8.5.40 and later
  • Apache Tomcat 7.0.94 and later

The vulnerability was reported to the Apache Tomcat security team by an unnamed security expert on 3rd March 2019 and was publicly disclosed on 10 April 2019 after the release of the new updated versions (Tomcat version 9.0.19, version 8.5.40 and version 7.0.93).

If you are using a Tomcat application server don’t forget to install the software updates as soon as possible. In case for some reason you cannot apply the patches immediately, you should check that default enableCmdLineArguments value is disabled.

Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.

APPLY NOW