Apache Tomcat Flaw CVE-2024-56337 Allows RCE Attacks

December 24, 2024December 24, 2024

Apache Software Foundation Releases Critical Security Update for Tomcat Server

The Apache Software Foundation (ASF) has issued a crucial security update to its Tomcat server software, addressing a significant vulnerability that could lead to remote code execution (RCE). This vulnerability, identified as CVE-2024-56337, serves as an incomplete mitigation for another serious flaw, CVE-2024-50379, which was previously reported on December 17, 2024. With a CVSS score of 9.8, these vulnerabilities highlight essential security risks for users of Apache Tomcat.

Understanding the Vulnerability in Apache Tomcat

The newly discovered CVE-2024-56337 affects users running Tomcat on case-insensitive file systems where the default servlet write is enabled. According to ASF’s advisory, users may need to make additional configurations based on the Java version they are using to fully mitigate these vulnerabilities. Both CVEs are classified as Time-of-check Time-of-use (TOCTOU) race condition vulnerabilities, posing a serious risk of code execution when the default servlet is set for write access.

Key Details of Vulnerability CVE-2024-56337

The following versions of Apache Tomcat are impacted by this vulnerability:

Apache Tomcat 11.0.0-M1 to 11.0.1 (Fixed in 11.0.2 or later)
Apache Tomcat 10.1.0-M1 to 10.1.33 (Fixed in 10.1.34 or later)
Apache Tomcat 9.0.0.M1 to 9.0.97 (Fixed in 9.0.98 or later)

Recommended Configuration Changes

Users must implement specific configuration changes based on their Java version:

Java 8 or Java 11: Set the system property sun.io.useCanonCaches to false (default is true).
Java 17: Ensure that the system property sun.io.useCanonCaches is set to false.
Java 21 and later: No action is required as this property has been removed.

Acknowledgments and Related Vulnerabilities

The ASF credited several security researchers, including Nacl, WHOAMI, Yemoli, and Ruozhi, for identifying and reporting these vulnerabilities. Additionally, the KnownSec 404 Team was acknowledged for independently reporting CVE-2024-56337 with a proof-of-concept (PoC) code.

This disclosure follows a separate announcement by the Zero Day Initiative (ZDI) regarding a critical bug in Webmin (CVE-2024-12828), which has a CVSS score of 9.9. This flaw allows authenticated remote attackers to execute arbitrary code due to inadequate validation of user-supplied input.

Conclusion and Next Steps

For users of Apache Tomcat, addressing these vulnerabilities promptly is crucial to maintaining system security. It’s important to ensure your software is updated to the latest versions and to configure your systems according to the recommended guidelines.

If you found this information valuable, please share your thoughts in the comments below. For more insights and updates on cybersecurity, follow us on Twitter and LinkedIn for exclusive content.

For further reading on Apache Tomcat vulnerabilities, check out Apache Tomcat Security and stay informed about the latest in cybersecurity news through the Zero Day Initiative.

AMD Chip Flaw Poses Risk to Cloud Data, Researchers Warn

December 20, 2024December 20, 2024

Researchers have identified a critical vulnerability in AMD processors, known as “badRAM,” which threatens cloud computing environments by allowing attackers with physical access to bypass encryption. This flaw targets AMD’s Secure Encrypted Virtualization (SEV) by manipulating the Serial Presence Detect (SPD) chip on memory modules. Attackers can deceive the memory module into revealing encrypted data, exploiting aliasing issues. While the vulnerability requires physical access, it poses risks from malicious insiders and corrupt employees. AMD has issued firmware updates and recommends using locked SPD chips and enhancing physical security to mitigate risks. Organizations must stay informed to protect sensitive data.

Attacks Linked to Major GFI KerioControl Firewall Flaw

January 10, 2025January 10, 2025

GFI KerioControl firewalls are vulnerable to a critical security flaw, CVE-2024-52857, enabling CRLF injection, which has been exploited since December 28. This vulnerability allows attackers to manipulate HTTP response headers, leading to severe risks such as remote code execution, HTTP response splitting attacks, and reflected cross-site scripting (XSS). Security experts urge the nearly 24,000 affected users to apply patches immediately to protect their networks. The flaw was identified by researcher Egidio Romano, with attacks traced back to specific IP addresses in Singapore and Hong Kong. Regular updates and security audits are crucial for safeguarding against such threats.

New DoubleClickjacking Exploit Bypasses Web Protections

January 1, 2025January 1, 2025

A newly identified vulnerability called DoubleClickjacking poses serious risks to major websites by enabling clickjacking attacks and potential account takeovers. Security researcher Paulos Yibelo highlights this timing-based vulnerability, which exploits a double-click sequence, complicating web security. Unlike traditional clickjacking, DoubleClickjacking manipulates user interfaces by leveraging the time gap between clicks. Attacks typically involve user interaction with a deceptive page, leading to unauthorized permissions. Existing security measures, like X-Frame-Options, are inadequate against this threat. To mitigate risks, website owners are advised to implement client-side prevention strategies and advocate for new browser standards.

Why Security Leaders Struggle to Secure Funding

December 11, 2024December 11, 2024

In 2024, cybersecurity threats have reached unprecedented levels, with 55% of organizations reporting significant security risks and half facing weekly attacks. Advanced AI-driven threats complicate defense efforts, yet only 11% of IT budgets are allocated to security—far below the recommended 17%. The average cost of a data breach has risen to $4.88 million, highlighting the financial repercussions of underinvestment. Compliance challenges are also growing, with companies spending over 11 weeks on manual security tasks. Investing in cybersecurity not only safeguards data but also enhances customer trust, reduces financial risks, and positions businesses for growth in a complex threat landscape.

Veeam Releases Patch for Critical RCE Vulnerability

December 4, 2024December 4, 2024

Veeam has released critical security updates for its Service Provider Console (VSPC) to fix a severe vulnerability, CVE-2024-42448, which has a CVSS score of 9.9, allowing potential remote code execution. Discovered during internal testing, this flaw necessitates immediate user action to safeguard systems. A second vulnerability, CVE-2024-42449, with a CVSS score of 7.1, could lead to NTLM hash leakage and file deletion. Both vulnerabilities affect VSPC version 8.1.0.21377 and earlier. Users are urged to upgrade to version 8.1.0.21999 to mitigate these risks, as no other solutions are available for earlier builds.

ActiveState Unveils New End-to-End OS Platform for Enterprises

December 18, 2024December 18, 2024

ActiveState has launched a new platform designed to enhance open source management and security, addressing the complexities enterprises face as over 90% of software now includes open source components. With the rise of remote work increasing security risks, ActiveState’s platform implements a four-step management cycle: Discovery, Prioritization, Upgrading and Curating, and Build and Deploy. This structured approach aims to improve visibility, manage vulnerabilities, and ensure compliance. ActiveState’s initiative not only responds to the challenges of open source security but also empowers organizations by fostering collaboration and providing tools for effective governance and risk management.