Malware, Network Security, Vulnerability Management

Apache Tomcat vulnerability results in remote code exectuion

Security researchers identified a remote code execution on windows vulnerability in Apache Tomcat.

The vulnerability is rated “Important” and was identified by an external security researcher and reported to the Apache Tomcat security team via the bug bounty program, according to an April 10 blog post.

The vulnerability leaves the CGI Servlet at risk due to a flaw in the way the JRE passes command line arguments to Windows and occurs when running on Windows with enableCmdLineArguments enabled.

Both the CGI Servlet and the CGI option enableCmdLineArguments are disabled by default in Tomcat 9.0.x and will be disabled by default in all versions in response to this vulnerability.

Researchers recommend users of affected versions should apply one of the following mitigations to ensure the CGI Servlet initialization parameter enableCmdLineArguments is set to false and upgrading to the latest version of Apache Tomcat.

Related

Rootkit capabilities likely with Windows bugs

Several rootkit-like capabilities could be obtained by threat actors through the exploitation of vulnerabilities in Windows' DOS-to-NT path conversion process, including file and process concealment and compromised prefetch file analysis, reports The Hacker News.

Abusing GitHub flaw could compromise GitLab

Open-source DevOps software project GitLab has also been impacted by the same security issue in GitHub comments that has been exploited by threat actors through Microsoft repository-linked URLs to facilitate the distribution of malware that was made to seem to originate from credible entities' official source code repositories, according to BleepingComputer.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.