Sid 1-46071

Rule Documentation
References

Rule Category

SERVER-APACHE -- Snort has detected traffic exploiting vulnerabilities in Apache servers.

Alert Message

SERVER-APACHE Apache Tomcat Java JmxRemoteLifecycleListener unauthorized serialized object attempt

Rule Explanation

This event is generated when attacker attempts to exploit an Apache Tomcat remote code execution vulnerability. Impact: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service Details: Ease of Attack: Medium

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2016-8735

Additional Links

github.com/frohoff/ysoserial

tomcat.apache.org/security-6.html

Rule Vulnerability

CVE Additional Information

CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Details
Severity		Base Score	9.8
Impact Score	5.9	Exploit Score	3.9
Confidentiality Impact	HIGH	Integrity Impact	HIGH
Availability Impact	HIGH	Access Vector
Authentication		Ease of Access