Vulnerabilities > CVE-2018-8020 - Improper Certificate Validation vulnerability in multiple products

047910
CVSS 7.4 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
NONE
network
high complexity
debian
apache
CWE-295
nessus

Summary

Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Creating a Rogue Certificate Authority Certificate
    An attacker exploits a weakness in the MD5 hash algorithm (weak collision resistance) to generate a certificate signing request (CSR) that contains collision blocks in the "to be signed" part. The attacker specially crafts two different, but valid X.509 certificates that when hashed with the MD5 algorithm would yield the same value. The attacker then sends the CSR for one of the certificates to the Certification Authority which uses the MD5 hashing algorithm. That request is completely valid and the Certificate Authority issues an X.509 certificate to the attacker which is signed with its private key. An attacker then takes that signed blob and inserts it into another X.509 certificate that the attacker generated. Due to the MD5 collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the attackers' second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority. To make the attack more interesting, the second certificate could be not just a regular certificate, but rather itself a signing certificate. Thus the attacker is able to start their own Certification Authority that is anchored in its root of trust in the legitimate Certification Authority that has signed the attackers' first X.509 certificate. If the original Certificate Authority was accepted by default by browsers, so will now the Certificate Authority set up by the attacker and of course any certificates that it signs. So the attacker is now able to generate any SSL certificates to impersonate any web server, and the user's browser will not issue any warning to the victim. This can be used to compromise HTTPS communications and other types of systems where PKI and X.509 certificates may be used (e.g., VPN, IPSec) .

Nessus

  • NASL familyMisc.
    NASL idSYMANTEC_CONTENT_ANALYSIS_SYMSA1463.NASL
    descriptionThe version of Symantec Content Analysis running on the remote host is prior to version 2.3.5.1. It is, therefore, affected by multiple vulnerabilities: - An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. (CVE-2018-1336) - When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS.(CVE-2018-8019) - Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. (CVE-2018-8020) - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. (CVE-2018-8034)
    last seen2020-06-01
    modified2020-06-02
    plugin id125550
    published2019-05-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125550
    titleSymantec Content Analysis < 2.3.5.1 affected by Multiple Vulnerabilities (SYMSA1463)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(125550);
      script_version("1.2");
      script_cvs_date("Date: 2019/10/30 13:24:46");
    
      script_cve_id(
        "CVE-2018-1336",
        "CVE-2018-8019",
        "CVE-2018-8020",
        "CVE-2018-8034"
      );
      script_bugtraq_id(
        104895,
        104898,
        104934,
        104936
      );
    
      script_name(english:"Symantec Content Analysis < 2.3.5.1 affected by Multiple Vulnerabilities (SYMSA1463)");
      script_summary(english:"Checks the version of Symantec Content Analysis");
    
      script_set_attribute(attribute:"synopsis", value:
      "The remote host is running a version of Symantec Content Analysis that is
      affected by Multiple Vulnerabilities");
        script_set_attribute(attribute:"description", value:
      "The version of Symantec Content Analysis running on the
      remote host is prior to version 2.3.5.1. It is, therefore,
      affected by multiple vulnerabilities:
        - An improper handing of overflow in the UTF-8 decoder
          with supplementary characters can lead to an infinite
          loop in the decoder causing a Denial of Service.
          (CVE-2018-1336)
    
        - When using an OCSP responder Apache Tomcat Native
          1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly
          handle invalid responses. This allowed for revoked client
          certificates to be incorrectly identified. It was therefore
          possible for users to authenticate with revoked certificates
          when using mutual TLS.(CVE-2018-8019)
          
        - Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has
          a flaw that does not properly check OCSP pre-produced responses,
          which are lists (multiple entries) of certificate statuses.
          (CVE-2018-8020)
    
        - The host name verification when using TLS with the
          WebSocket client was missing. It is now enabled by
          default. (CVE-2018-8034)
    
        ");
        # https://support.symantec.com/en_US/article.SYMSA1463.html
        script_set_attribute(attribute:"see_also", value:"https://support.symantec.com/en_US/article.SYMSA1463.html");
        script_set_attribute(attribute:"solution", value:
      "Refer to vendor advisory (Symantec SYMSA1463) for suggested
      workaround, or upgrade to an unaffected version.");
        script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
        script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
        script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
        script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
        script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8034");
        script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      
        script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/22");
        script_set_attribute(attribute:"patch_publication_date", value:"2018/10/11");
        script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/30");
      
        script_set_attribute(attribute:"plugin_type", value:"local");
        script_set_attribute(attribute:"cpe", value:"x-cpe:/h:symantec:content_analysis");
        script_set_attribute(attribute:"cpe", value:"x-cpe:/h:bluecoat:content_analysis");
        script_end_attributes();
      
        script_category(ACT_GATHER_INFO);
        script_family(english:"Misc.");
      
        script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      
        script_dependencies("symantec_content_analysis_local_detect.nbin");
        script_require_keys("installed_sw/Symantec Content Analysis");
      
        exit(0);
    }
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    include('vcf.inc');
    
    app_name = 'Symantec Content Analysis';
    
    app_info = vcf::get_app_info(app:app_name, port:0);
    
    constraints = [
      {'min_version': '2.2', 'max_version': '2.3', 'fixed_display': 'Refer to vendor advisory.' },
      {'min_version': '2.3', 'fixed_version' : '2.3.5.1'}
    ];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-14014-1.NASL
    descriptionThis update for libtcnative-1-0 to version 1.1.34 fixes the following issues : CVE-2017-15698: Fixed an improper handling of fields with more than 127 bytes which could allow invalid client certificates to be accepted (bsc#1078679). CVE-2018-8019: When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (bsc#1103348). CVE-2018-8020: Did not properly check OCSP pre-produced responses. Revoked client certificates may have not been properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS (bsc#1103347). For a complete list of changes please see http://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id123971
    published2019-04-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123971
    titleSUSE SLES11 Security Update : libtcnative-1-0 (SUSE-SU-2019:14014-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2019:14014-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(123971);
      script_version("1.1");
      script_cvs_date("Date: 2019/04/10  9:44:55");
    
      script_cve_id("CVE-2017-15698", "CVE-2018-8019", "CVE-2018-8020");
    
      script_name(english:"SUSE SLES11 Security Update : libtcnative-1-0 (SUSE-SU-2019:14014-1)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for libtcnative-1-0 to version 1.1.34 fixes the following
    issues :
    
    CVE-2017-15698: Fixed an improper handling of fields with more than
    127 bytes which could allow invalid client certificates to be accepted
    (bsc#1078679).
    
    CVE-2018-8019: When using an OCSP responder did not correctly handle
    invalid responses. This allowed for revoked client certificates to be
    incorrectly identified. It was therefore possible for users to
    authenticate with revoked certificates when using mutual TLS
    (bsc#1103348).
    
    CVE-2018-8020: Did not properly check OCSP pre-produced responses.
    Revoked client certificates may have not been properly identified,
    allowing for users to authenticate with revoked certificates to
    connections that require mutual TLS (bsc#1103347).
    
    For a complete list of changes please see
    http://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1078679"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1103347"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1103348"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-15698/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-8019/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-8020/"
      );
      # https://www.suse.com/support/update/announcement/2019/suse-su-201914014-1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c6248473"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Server 11-SP4-LTSS:zypper in -t patch
    slessp4-libtcnative-1-0-14014=1
    
    SUSE Linux Enterprise Point of Sale 11-SP3:zypper in -t patch
    sleposp3-libtcnative-1-0-14014=1
    
    SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch
    dbgsp4-libtcnative-1-0-14014=1
    
    SUSE Linux Enterprise Debuginfo 11-SP3:zypper in -t patch
    dbgsp3-libtcnative-1-0-14014=1"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libtcnative-1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/04/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/10");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = eregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^(SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES11", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES11" && (! ereg(pattern:"^(4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP4", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES11", sp:"4", reference:"libtcnative-1-0-1.3.4-12.5.5.2")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libtcnative-1-0");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-2469.NASL
    descriptionAn update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 4 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * tomcat: Insecure defaults in CORS filter enable
    last seen2020-06-01
    modified2020-06-02
    plugin id111804
    published2018-08-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111804
    titleRHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 4 (RHSA-2018:2469)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:2469. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(111804);
      script_version("1.6");
      script_cvs_date("Date: 2019/10/24 15:35:45");
    
      script_cve_id("CVE-2018-8014", "CVE-2018-8019", "CVE-2018-8020");
      script_xref(name:"RHSA", value:"2018:2469");
    
      script_name(english:"RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 4 (RHSA-2018:2469)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6
    and Red Hat JBoss Web Server 3.1 for RHEL 7.
    
    Red Hat Product Security has rated this release as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Red Hat JBoss Web Server is a fully integrated and certified set of
    components for hosting Java web applications. It is comprised of the
    Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat
    Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and
    the Tomcat Native library.
    
    This release of Red Hat JBoss Web Server 3.1 Service Pack 4 serves as
    a replacement for Red Hat JBoss Web Server 3.1, and includes bug
    fixes, which are documented in the Release Notes document linked to in
    the References.
    
    Security Fix(es) :
    
    * tomcat: Insecure defaults in CORS filter enable
    'supportsCredentials' for all origins (CVE-2018-8014)
    
    * tomcat-native: Mishandled OCSP invalid response (CVE-2018-8019)
    
    * tomcat-native: Mishandled OCSP responses can allow clients to
    authenticate with revoked certificates (CVE-2018-8020)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section.
    
    The following packages have been upgraded to a newer upstream 
    version :
    
    * OpenSSL (1.0.2n)
    
    * APR (1.6.3)
    
    CVE-2018-8019 and CVE-2018-8020 were discovered by Coty Sutherland
    (Red Hat)."
      );
      # https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/3.1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?0349df1b"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2018:2469"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8014"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8019"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8020"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat-native");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat-native-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-admin-webapps");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-docs-webapp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-el-2.2-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-javadoc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-jsp-2.2-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-jsvc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-lib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-log4j");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-selinux");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-servlet-3.0-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat7-webapps");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-admin-webapps");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-docs-webapp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-el-2.2-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-javadoc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-jsp-2.3-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-jsvc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-lib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-log4j");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-selinux");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-servlet-3.1-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:tomcat8-webapps");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/05/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/17");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x / 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2018:2469";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"tomcat-native-1.2.17-17.redhat_17.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"tomcat-native-1.2.17-17.redhat_17.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"tomcat-native-debuginfo-1.2.17-17.redhat_17.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"tomcat-native-debuginfo-1.2.17-17.redhat_17.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-admin-webapps-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-docs-webapp-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-el-2.2-api-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-javadoc-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-jsp-2.2-api-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-jsvc-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-lib-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-log4j-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-selinux-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-servlet-3.0-api-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat7-webapps-7.0.70-27.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-admin-webapps-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-docs-webapp-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-el-2.2-api-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-javadoc-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-jsp-2.3-api-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-jsvc-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-lib-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-log4j-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-selinux-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-servlet-3.1-api-8.0.36-31.ep7.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"tomcat8-webapps-8.0.36-31.ep7.el6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tomcat-native-1.2.17-17.redhat_17.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"tomcat-native-debuginfo-1.2.17-17.redhat_17.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-admin-webapps-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-docs-webapp-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-el-2.2-api-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-javadoc-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-jsp-2.2-api-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-jsvc-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-lib-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-log4j-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-selinux-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-servlet-3.0-api-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat7-webapps-7.0.70-27.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-admin-webapps-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-docs-webapp-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-el-2.2-api-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-javadoc-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-jsp-2.3-api-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-jsvc-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-lib-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-log4j-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-selinux-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-servlet-3.1-api-8.0.36-31.ep7.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"tomcat8-webapps-8.0.36-31.ep7.el7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tomcat-native / tomcat-native-debuginfo / tomcat7 / etc");
      }
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1475.NASL
    descriptionWhen using an OCSP responder Tomcat Native did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id112065
    published2018-08-23
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/112065
    titleDebian DLA-1475-1 : tomcat-native security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1475-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(112065);
      script_version("1.2");
      script_cvs_date("Date: 2018/10/04  9:31:13");
    
      script_cve_id("CVE-2018-8019", "CVE-2018-8020");
    
      script_name(english:"Debian DLA-1475-1 : tomcat-native security update");
      script_summary(english:"Checks dpkg output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "When using an OCSP responder Tomcat Native did not correctly handle
    invalid responses. This allowed for revoked client certificates to be
    incorrectly identified. It was therefore possible for users to
    authenticate with revoked certificates when using mutual TLS. Users
    not using OCSP checks are not affected by this vulnerability.
    
    For Debian 8 'Jessie', these problems have been fixed in version
    1.1.32~repack-2+deb8u2.
    
    We recommend that you upgrade your tomcat-native packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2018/08/msg00023.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/tomcat-native"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the affected libtcnative-1 package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libtcnative-1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"libtcnative-1", reference:"1.1.32~repack-2+deb8u2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Redhat

advisories
  • rhsa
    idRHSA-2018:2469
  • rhsa
    idRHSA-2018:2470
rpms
  • tomcat-native-0:1.2.17-17.redhat_17.ep7.el6
  • tomcat-native-0:1.2.17-17.redhat_17.ep7.el7
  • tomcat-native-debuginfo-0:1.2.17-17.redhat_17.ep7.el6
  • tomcat-native-debuginfo-0:1.2.17-17.redhat_17.ep7.el7
  • tomcat7-0:7.0.70-27.ep7.el6
  • tomcat7-0:7.0.70-27.ep7.el7
  • tomcat7-admin-webapps-0:7.0.70-27.ep7.el6
  • tomcat7-admin-webapps-0:7.0.70-27.ep7.el7
  • tomcat7-docs-webapp-0:7.0.70-27.ep7.el6
  • tomcat7-docs-webapp-0:7.0.70-27.ep7.el7
  • tomcat7-el-2.2-api-0:7.0.70-27.ep7.el6
  • tomcat7-el-2.2-api-0:7.0.70-27.ep7.el7
  • tomcat7-javadoc-0:7.0.70-27.ep7.el6
  • tomcat7-javadoc-0:7.0.70-27.ep7.el7
  • tomcat7-jsp-2.2-api-0:7.0.70-27.ep7.el6
  • tomcat7-jsp-2.2-api-0:7.0.70-27.ep7.el7
  • tomcat7-jsvc-0:7.0.70-27.ep7.el6
  • tomcat7-jsvc-0:7.0.70-27.ep7.el7
  • tomcat7-lib-0:7.0.70-27.ep7.el6
  • tomcat7-lib-0:7.0.70-27.ep7.el7
  • tomcat7-log4j-0:7.0.70-27.ep7.el6
  • tomcat7-log4j-0:7.0.70-27.ep7.el7
  • tomcat7-selinux-0:7.0.70-27.ep7.el6
  • tomcat7-selinux-0:7.0.70-27.ep7.el7
  • tomcat7-servlet-3.0-api-0:7.0.70-27.ep7.el6
  • tomcat7-servlet-3.0-api-0:7.0.70-27.ep7.el7
  • tomcat7-webapps-0:7.0.70-27.ep7.el6
  • tomcat7-webapps-0:7.0.70-27.ep7.el7
  • tomcat8-0:8.0.36-31.ep7.el6
  • tomcat8-0:8.0.36-31.ep7.el7
  • tomcat8-admin-webapps-0:8.0.36-31.ep7.el6
  • tomcat8-admin-webapps-0:8.0.36-31.ep7.el7
  • tomcat8-docs-webapp-0:8.0.36-31.ep7.el6
  • tomcat8-docs-webapp-0:8.0.36-31.ep7.el7
  • tomcat8-el-2.2-api-0:8.0.36-31.ep7.el6
  • tomcat8-el-2.2-api-0:8.0.36-31.ep7.el7
  • tomcat8-javadoc-0:8.0.36-31.ep7.el6
  • tomcat8-javadoc-0:8.0.36-31.ep7.el7
  • tomcat8-jsp-2.3-api-0:8.0.36-31.ep7.el6
  • tomcat8-jsp-2.3-api-0:8.0.36-31.ep7.el7
  • tomcat8-jsvc-0:8.0.36-31.ep7.el6
  • tomcat8-jsvc-0:8.0.36-31.ep7.el7
  • tomcat8-lib-0:8.0.36-31.ep7.el6
  • tomcat8-lib-0:8.0.36-31.ep7.el7
  • tomcat8-log4j-0:8.0.36-31.ep7.el6
  • tomcat8-log4j-0:8.0.36-31.ep7.el7
  • tomcat8-selinux-0:8.0.36-31.ep7.el6
  • tomcat8-selinux-0:8.0.36-31.ep7.el7
  • tomcat8-servlet-3.1-api-0:8.0.36-31.ep7.el6
  • tomcat8-servlet-3.1-api-0:8.0.36-31.ep7.el7
  • tomcat8-webapps-0:8.0.36-31.ep7.el6
  • tomcat8-webapps-0:8.0.36-31.ep7.el7