CVE-2016-1240 - Tomcat packaging on Debian-based distros - Local Root Privilege Escalation
Dawid Golunski <[email protected]> Wed, 26 Oct 2016 02:05:11 -0300
| Newsgroups | gmane.comp.security.oss.general,gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker |
|---|---|
| Message-ID | <CADSYzss90v5o_p40F5+_PHhS+EwP3K=FLsB-ak9xazRj9gtm6w@mail.gmail.com> |
I added a simple PoC video for the CVE-2016-1240 vulnerability. In the PoC I used Ubuntu 16.04 with the latest tomcat7 package (version: 7.0.68-ubuntu-0.1) installed from the default ubuntu repos which appears vulnerable still. The video poc can be found at: http://legalhackers.com/videos/Apache-Tomcat-DebPkg-Root-PrivEsc-Exploit.html -- Regards, Dawid Golunski http://legalhackers.com