Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability

Bugtraq ID:	74665
Class:	Design Error
CVE:	CVE-2014-7810
Remote:	Yes
Local:	No
Published:	May 14 2015 12:00AM
Updated:	May 23 2017 04:27PM
Credit:	Apache Tomcat security team
Vulnerable:	Ubuntu Ubuntu Linux 15.04 Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Redhat JBoss Enterprise Web Server 2 EL6 Redhat JBoss Enterprise Web Server 2 EL5 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Client Optional 7 Redhat Enterprise Linux 7 Client Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 IBM WebSphere Cast Iron 7.0 IBM WebSphere Cast Iron 6.1 IBM WebSphere Cast Iron 7.0.0.2 IBM WebSphere Cast Iron 7.0.0.1 IBM WebSphere Cast Iron 6.4.0.1 IBM WebSphere Cast Iron 6.4.0.0 IBM WebSphere Cast Iron 6.3.0.2 IBM WebSphere Cast Iron 6.3.0.1 IBM WebSphere Cast Iron 6.1.0.9 IBM WebSphere Cast Iron 6.1.0.8 IBM WebSphere Cast Iron 6.1.0.7 IBM WebSphere Cast Iron 6.1.0.6 IBM WebSphere Cast Iron 6.1.0.15 IBM WebSphere Cast Iron 6.1.0.12 IBM WebSphere Cast Iron 6.0.0.6 IBM WebSphere Cast Iron 6.0.0.5 IBM WebSphere Cast Iron 6.0.0.4 IBM WebSphere Cast Iron 6.0.0.3 IBM Tivoli Application Dependency Discovery Manager 7.2.2 IBM Tivoli Application Dependency Discovery Manager 7.2.1 3 IBM Tivoli Application Dependency Discovery Manager 7.2.1 2 IBM Tivoli Application Dependency Discovery Manager 7.2.1 1 IBM Tivoli Application Dependency Discovery Manager 7.2.1 IBM Tivoli Application Dependency Discovery Manager 7.1.2 8 IBM Tivoli Application Dependency Discovery Manager 7.1.2 7 IBM Tivoli Application Dependency Discovery Manager 7.1.2 6 IBM Tivoli Application Dependency Discovery Manager 7.1.2 5 IBM Tivoli Application Dependency Discovery Manager 7.1.2 4 IBM Tivoli Application Dependency Discovery Manager 7.1.2 3 IBM Tivoli Application Dependency Discovery Manager 7.1.2 2 IBM Tivoli Application Dependency Discovery Manager 7.3.0.1 IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 IBM Tivoli Application Dependency Discovery Manager 7.2.2.3 IBM Tivoli Application Dependency Discovery Manager 7.2.2.2 IBM Tivoli Application Dependency Discovery Manager 7.2.2.1 IBM Tivoli Application Dependency Discovery Manager 7.2.1.6 IBM Tivoli Application Dependency Discovery Manager 7.2.1.5 IBM Tivoli Application Dependency Discovery Manager 7.2.1.4 IBM Tivoli Application Dependency Discovery Manager 7.2.0.9 IBM Tivoli Application Dependency Discovery Manager 7.2.0.8 IBM Tivoli Application Dependency Discovery Manager 7.2.0.7 IBM Tivoli Application Dependency Discovery Manager 7.2.0.6 IBM Tivoli Application Dependency Discovery Manager 7.2.0.5 IBM Tivoli Application Dependency Discovery Manager 7.2.0.4 IBM Tivoli Application Dependency Discovery Manager 7.2.0.3 IBM Tivoli Application Dependency Discovery Manager 7.2.0.2 IBM Tivoli Application Dependency Discovery Manager 7.2.0.10 IBM Tivoli Application Dependency Discovery Manager 7.2.0.1 IBM Tivoli Application Dependency Discovery Manager 7.2.0 IBM Tivoli Application Dependency Discovery Manager 7.2 IBM Tivoli Application Dependency Discovery Manager 7.1.2 IBM Cognos TM1 10.2.2 IBM Cognos TM1 9.5.2 IBM Cognos TM1 10.2 IBM Cognos TM1 10.1.1 IBM Cognos Express 10.2.2 IBM Cognos Express 10.1 IBM Cognos Express 9.5.2 IBM Cognos Express 10.2.1 IBM Cognos Business Viewpoint 10.1.1 FP2 IBM Cognos Business Viewpoint 10.1 FP1 HP Tomcat 6.0.33.01 for HP-UX B.11.31 0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 7 Apache Tomcat 8.0.15 Apache Tomcat 8.0.9 Apache Tomcat 8.0.8 Apache Tomcat 8.0.5 Apache Tomcat 8.0.3 Apache Tomcat 8.0.1 Apache Tomcat 7.0.57 Apache Tomcat 7.0.54 Apache Tomcat 7.0.53 Apache Tomcat 7.0.50 Apache Tomcat 7.0.33 Apache Tomcat 7.0.32 Apache Tomcat 7.0.31 Apache Tomcat 7.0.30 Apache Tomcat 7.0.29 Apache Tomcat 7.0.28 Apache Tomcat 7.0.27 Apache Tomcat 7.0.26 Apache Tomcat 7.0.25 Apache Tomcat 7.0.24 Apache Tomcat 7.0.23 Apache Tomcat 7.0.16 Apache Tomcat 7.0.15 Apache Tomcat 7.0.14 Apache Tomcat 7.0.13 Apache Tomcat 7.0.12 Apache Tomcat 7.0.9 Apache Tomcat 7.0.8 Apache Tomcat 7.0.7 Apache Tomcat 7.0.6 Apache Tomcat 7.0.4 Apache Tomcat 7.0.3 Apache Tomcat 7.0.2 Apache Tomcat 7.0.1 Apache Tomcat 7.0 Apache Tomcat 6.0.43 Apache Tomcat 6.0.41 Apache Tomcat 6.0.37 Apache Tomcat 6.0.36 Apache Tomcat 6.0.35 Apache Tomcat 6.0.29 Apache Tomcat 6.0.28 Apache Tomcat 6.0.27 Apache Tomcat 6.0.26 Apache Tomcat 6.0.25 Apache Tomcat 6.0.24 Apache Tomcat 6.0.20 Apache Tomcat 6.0.18 Apache Tomcat 6.0.17 Apache Tomcat 6.0.16 Apache Tomcat 6.0.15 Apache Tomcat 6.0.14 Apache Tomcat 6.0.13 Apache Tomcat 6.0.12 Apache Tomcat 6.0.11 Apache Tomcat 6.0.10 Apache Tomcat 6.0.9 Apache Tomcat 6.0.8 Apache Tomcat 6.0.7 Apache Tomcat 6.0.6 Apache Tomcat 6.0.5 Apache Tomcat 6.0.4 Apache Tomcat 6.0.3 Apache Tomcat 6.0.2 Apache Tomcat 6.0.1 Apache Tomcat 6.0 Apache Tomcat 8.0.0-RC6 Apache Tomcat 8.0.0-RC5 Apache Tomcat 8.0.0-RC3 Apache Tomcat 8.0.0-RC10 Apache Tomcat 8.0.0-RC1 Apache Tomcat 8.0.0 Rc5 Apache Tomcat 8.0.0 Rc2 Apache Tomcat 8.0.0 Rc10 Apache Tomcat 8.0.0 Rc1 Apache Tomcat 7.0.55 Apache Tomcat 7.0.5 Apache Tomcat 7.0.49 Apache Tomcat 7.0.48 Apache Tomcat 7.0.47 Apache Tomcat 7.0.46 Apache Tomcat 7.0.45 Apache Tomcat 7.0.44 Apache Tomcat 7.0.43 Apache Tomcat 7.0.42 Apache Tomcat 7.0.41 Apache Tomcat 7.0.40 Apache Tomcat 7.0.39 Apache Tomcat 7.0.38 Apache Tomcat 7.0.37 Apache Tomcat 7.0.36 Apache Tomcat 7.0.35 Apache Tomcat 7.0.34 Apache Tomcat 7.0.22 Apache Tomcat 7.0.21 Apache Tomcat 7.0.20 Apache Tomcat 7.0.19 Apache Tomcat 7.0.18 Apache Tomcat 7.0.17 Apache Tomcat 7.0.11 Apache Tomcat 7.0.10 Apache Tomcat 6.0.42 Apache Tomcat 6.0.39 Apache Tomcat 6.0.33 Apache Tomcat 6.0.32 Apache Tomcat 6.0.31 Apache Tomcat 6.0.30 Apache Tomcat 6.0.19
Not Vulnerable:	IBM Cognos Express 10.2.1 FP4 HP Tomcat 6.0.45.01 for HP-UX B.11.31 0 Apache Tomcat 8.0.17 Apache Tomcat 7.0.59 Apache Tomcat 6.0.44

Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability

Apache Tomcat is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks.

Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability

References:

• Apache Tomcat 8.x vulnerabilities (Apache)
  
• Apache Tomcat Homepage (Apache)
  
• CVE-2014-7810: Apache Tomcat Security Manager Bypass (Seclists.org)
  
• HPSBUX03561 rev.1 - HPE HP-UX using Apache Tomcat, Remote Access Restriction Byp (HP)
  
• IBM Advisory swg21961088 (IBM)
  
• IBM Advisory swg21966177 (IBM)
  
• IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities (C (IBM)
  
• Red Hat JBoss Web Server 2.1.0 tomcat security update (Red Hat)
  
• Security Bulletin: Multiple security vulnerabilities in Open Source Apache Tomca (IBM)
  
• swg21972376 : Multiple Security Vulnerabilities exist in IBM Cognos Express. (IBM)