September 30, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Advisory – CVE-2019-0859 – Win32k Privilege Escalation Vulnerability
April 16, 2019
Rewterz Threat Alert – Malspam Drops GandCrab Ransomware
April 16, 2019
Rewterz Threat Advisory – CVE-2019-0859 – Win32k Privilege Escalation Vulnerability
April 16, 2019
Rewterz Threat Alert – Malspam Drops GandCrab Ransomware
April 16, 2019
Severity
High
Analysis Summary
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability).
Impact
System access
Affected Vendors
Apache Foundation
Affected Products
- Apache Tomcat 7.x
- Apache Tomcat 8.x
- Apache Tomcat 9.x
Remediation
Update to version 7.0.94, 8.5.40, or 9.0.19.