{
  "threat_severity" : "Important",
  "public_date" : "2013-05-28T00:00:00Z",
  "bugzilla" : {
    "description" : "tomcat: Improper TOMCAT_LOG management in init script (DoS, ACE)",
    "id" : "927622",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=927622"
  },
  "cvss" : {
    "cvss_base_score" : "6.9",
    "cvss_scoring_vector" : "AV:L/AC:M/Au:N/C:C/I:C/A:C",
    "status" : "verified"
  },
  "details" : [ "The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log." ],
  "statement" : "This flaw pertains to the init scripts provided by the RPM distribution of tomcat in various Red Hat products. ZIP distributions do not include init scripts, and are not affected by this flaw.",
  "acknowledgement" : "Red Hat would like to thank Simon Fayer (Imperial College London) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0870",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5",
    "package" : "tomcat5-0:5.5.23-0jpp.40.el5_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0869",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "tomcat6-0:6.0.24-55.el6_4"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 1 for RHEL 5",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0872",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:1::el5",
    "package" : "tomcat5-0:5.5.33-33_patch_09.ep5.el5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 1 for RHEL 5",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0872",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:1::el5",
    "package" : "tomcat6-0:6.0.32-32_patch_09.ep5.el5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 1 for RHEL 6",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0872",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:1::el6",
    "package" : "tomcat5-0:5.5.33-36_patch_09.ep5.el6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 1 for RHEL 6",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0872",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:1::el6",
    "package" : "tomcat6-0:6.0.32-35_patch_09.ep5.el6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 2 for RHEL 5",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0871",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:2::el5",
    "package" : "tomcat6-0:6.0.35-12_patch_07.ep6.el5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 2 for RHEL 5",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0871",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:2::el5",
    "package" : "tomcat7-0:7.0.30-5_patch_03.ep6.el5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 2 for RHEL 6",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0871",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:2::el6",
    "package" : "tomcat6-0:6.0.35-33_patch_07.ep6.el6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 2 for RHEL 6",
    "release_date" : "2013-05-28T00:00:00Z",
    "advisory" : "RHSA-2013:0871",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:2::el6",
    "package" : "tomcat7-0:7.0.30-7_patch_03.ep6.el6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2013-1976\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-1976" ],
  "name" : "CVE-2013-1976",
  "csaw" : false
}