Skip to main content
Support

KB Article #179725

Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2016

List of possible security vulnerabilities reported against SecureTransport and corresponding analysis based on Axway's research.


NOTE: This KB lists only the vulnerabilities, tagged with the year 2016. For CVEs from other years, refer to the following articles:
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2018
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2017
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2015
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2014
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2013
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2012
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2011
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2010
Security Vulnerabilities (CVE) reported against SecureTransport tagged with the year 2009 and earlier


Additional lists of security vulnerabilities reported against SecureTransport application without formal CVE/CWE identifiers or against ST appliance platforms can be found at :



CVE Reference CVSS v2 Base Score Attack Vector Version Reported Version Fixed KB Article
CVE-2016-1238 7.8 Local 5.0 5.0 Patch 100 -
Added: N/A Last modified: N/A

The vulnerability is with Perl version used.


Currently supported ST versions 5.2.x do no use Perl (apart during install phase on RHEL with embedded MySQL database) thus not affected

CVE-2016-6662 8.8 Network 5.3.1, 5.3.3 5.3.1 Patch 13
5.3.3 Patch 6
-
Added: N/A Last modified: N/A

Pre-5.3.1 versions are using older non vulnerable mysql versions.


For the affected 5.3.1 and 5.3.3 ST versions - fixed via MySQL upgrade to a non-vulnerable version

CVE-2016-3092 7.5 Network 5.0 5.0 Patch 98 -
Added: N/A Last modified: N/A

Specific to the Tomcat version used in ST 5.0

CVE-2016-2108 9.8 Network 5.2.1 - 5.3.3 N/A -
Added: N/A Last modified: N/A

5.2.1 SP2 to 5.2.1 SP6 are using OpenSSL, but not for networking.


5.2.1 SP7 is not using OpenSSL.


5.3.0 is using OpenSSL, but not for networking.


5.3.1 is using OpenSSL, but not for networking.


5.3.3 and above are not using OpenSSL

CVE-2016-8735 N/A N/A 5.3.1 5.3.1 Patch 14 -
Added: N/A Last modified: N/A

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.


This was fixed in revision 1767676.


This issue was reported to the Apache Tomcat Security Team on 19 October 2016 and made public on 22 November 2016.


Affects: 7.0.0 to 7.0.72


See:
Apache Tomcat page
Mitre status is still RESERVED


Fixed in ST 5.3.1 Patch 14 with update to tomcat 7.0.75

CVE-2016-6796 N/A N/A 5.3.1 5.3.1 Patch 14 -
Added: N/A Last modified: N/A

The code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response, the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other than their own.


This was fixed in revision 1767675.


This issue was reported to the Apache Tomcat Security Team on 11 October 2016 and made public on 22 November 2016.


Affects: 7.0.0 to 7.0.72


See :
Apache Tomcat page
Mitre status is still RESERVED.


Fixed in 5.3.1 patch 14 with update to tomcat 7.0.75

CVE-2016-6794 N/A N/A 5.3.1 5.3.1 Patch 12
5.3.5 and above
-
Added: N/A Last modified: N/A

Fixed in 5.3.1 Patch 12 with update to Tomcat 7.0.72

CVE-2016-0762 N/A N/A 5.3.1 5.3.1 Patch 12
5.3.5 and above
-
Added: N/A Last modified: N/A

Timing Attack


The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.


This was fixed in revision 1758502.


This issue was identified by the Apache Tomcat Security Team on 1 January 2016 and made public on 27 October 2016.


Affects: 7.0.0 to 7.0.70


See: https://tomcat.apache.org/security-7.html


Fixed in 5.3.1 patch 12 with update to tomcat 7.0.72

CWE-327 N/A N/A N/A N/A -
Added: N/A Last modified: N/A

Generic item describing use of a Broken or Risky Cryptographic Algorithm

Each case to be treated separately based on use case reported specifics.

CVE-2016-3092 7.5 Network 5.0 5.0 Patch 98 -
Added: N/A Last modified: N/A

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

CVE-2016-6329 5.9 Network 5.2.1.x
5.3.1
5.3.3 -
Added: N/A Last modified: N/A

OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.


Removing 3DES and DES ciphers from respective daemons ciphers suites eliminates the issue, however in case for AS2 3DES is a must when used with FIPS 140-2.


Recommended approach is upgrade to ST 5.3.3

CVE-2016-0800 5.9 Network N/A N/A Statement
Added: N/A Last modified: N/A

ST is not vulnerable.