CVE-2016-1240

What it actually does

The Tomcat init script fails to validate the Catalina log file path, permitting a local user to replace it with a symlink that points to an arbitrary file, resulting in root-owned writes that enable privilege escalation.

Why it matters to the business

Attackers who already have a low-privileged account on affected systems can obtain full root control, leading to complete compromise of the server, data theft, or ransomware deployment; the issue remains relevant on long-lived deployments and requires urgent patching of the listed package.

How an attack unfolds

An attacker with tomcat account access creates a symlink from the expected Catalina log location to a sensitive file such as /etc/shadow or a cron script, then triggers a log rotation or restart via the init script so that the script writes as root to the attacker-controlled target, granting root privileges.

How to fix it

Upgrade step-fips (Chainguard) to version 0.26.2-r1 or later; on Debian and Ubuntu systems ensure tomcat packages are updated to the versions listed in the advisory; remove or restrict write access to log directories for the tomcat user where possible.

How to confirm the fix worked

Verify the installed package version matches or exceeds the fixed release; inspect the init script for proper handling of the log file path without following symlinks; run a non-privileged test that attempts the symlink and confirm the write does not succeed with elevated ownership.

Typical attack path

1. Obtain access to the tomcat user account on a vulnerable system
2. Create a symlink replacing the Catalina log file with a path to a privileged target
3. Trigger log activity or service restart through the init script
4. Leverage the resulting root-owned file write to escalate privileges

How to detect it

Examine system logs and file integrity data for unexpected symlinks or ownership changes on Tomcat Catalina log files; search process execution history and cron or init logs for tomcat service restarts initiated by non-root accounts; review file creation timestamps around known vulnerable package versions.

• /var/log/tomcat*/catalina.out -> /etc/passwd
• /var/log/tomcat*/catalina.out -> /etc/shadow
• tomcat init script writing as root to symlink target

What your security team should do

• Immediately upgrade step-fips (Chainguard) to 0.26.2-r1
• Audit all Tomcat instances for the vulnerable init script versions
• Restrict tomcat user permissions on log directories and monitor for unexpected symlinks
• Review systems for prior unauthorized root-owned files in Tomcat log paths