Apache Tomcat 7

Tenable plugin 121119 maps to CVE-2016-3092, a CPU-consumption denial of service in the package-renamed copy of Apache Commons FileUpload used by Apache Tomcat 7.0.0 through 7.0.69. The trigger is a crafted multipart/form-data request where the boundary length sits just below Tomcat's 4096-byte read buffer, making file upload parsing take orders of magnitude longer than normal.

The vendor's HIGH label follows the unauthenticated network-reachable DoS math, but it overshoots real enterprise risk. This is not RCE, not auth bypass, not data theft; it only matters on applications that actually parse multipart uploads, and modern reverse proxies, upload limits, rate controls, and autoscaling all add real friction. For most fleets this is a downgrade to MEDIUM unless the host runs a business-critical internet-facing upload workflow where availability loss is itself mission-critical.

Why this verdict

• Down from HIGH because this is DoS only — the CVSS is driven entirely by availability impact; there is no auth bypass, data exposure, or code execution.
• Down again because attacker reachability is narrower than the score implies — exploitation requires a live multipart/form-data upload path, and many Tomcat services do not expose one externally.
• Down again because common controls add real drag — reverse proxies, WAFs, request-size limits, and rate limiting often break or dampen malformed upload abuse before Tomcat burns CPU.

Why not higher?

There is no evidence here of broad in-the-wild exploitation, no KEV listing, and no post-exploitation value beyond temporary service degradation. A flaw that only burns CPU on specific upload endpoints should not sit in the same bucket as unauthenticated RCE on every exposed node.

Why not lower?

I am not dropping this to LOW because the trigger is still remote, unauthenticated, and cheap to generate. If you run a public upload-heavy workflow on old Tomcat 7, an attacker can create meaningful operational pain without owning the box.

1. Clamp multipart request size and rate — Set strict body-size, part-count, and per-IP rate limits at the reverse proxy or API gateway so abnormal upload traffic is rejected before Tomcat parses it. For a MEDIUM verdict there is no mitigation SLA, but apply this opportunistically on internet-facing upload paths while you work toward patching within the remediation window.
2. Hide or gate upload endpoints — Move admin/import/upload functions behind authentication, VPN, or an internal ingress tier where feasible. This directly removes the unauthenticated remote precondition that makes the bug interesting.
3. Watch upload handlers, not just host CPU — Alert on long-running multipart POSTs, upload endpoint latency, thread pool exhaustion, and repeated oversized boundary strings. This catches abuse faster than generic host-availability alerts.
4. Drain legacy Tomcat 7 from public duty — Even if this single CVE is only MEDIUM, a public-facing Tomcat 7 estate is technical debt with a growing vulnerability stack. Use this finding as leverage to retire or front-end-isolate the platform.

Run this on the target Tomcat host or from an auditor workstation that can read the Tomcat install directory over SSH or a mounted filesystem. Invoke it as python3 verify_tomcat_121119.py /opt/tomcat with read access only; no root is required. It checks an upstream Tomcat install tree and reports VULNERABLE, PATCHED, or UNKNOWN for this specific 7.0.0 < 7.0.70 finding.

#!/usr/bin/env python3
# verify_tomcat_121119.py
# Check Apache Tomcat against Nessus plugin 121119 / CVE-2016-3092
# Usage: python3 verify_tomcat_121119.py /path/to/tomcat
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import zipfile

TARGET_FIXED = (7, 0, 70)


def parse_version(text):
    m = re.search(r'Apache Tomcat/?\s*([0-9]+)\.([0-9]+)\.([0-9]+)', text)
    if not m:
        m = re.search(r'([0-9]+)\.([0-9]+)\.([0-9]+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def read_server_info(catalina_home):
    candidates = [
        os.path.join(catalina_home, 'lib', 'catalina.jar'),
        os.path.join(catalina_home, 'server', 'lib', 'catalina.jar'),
    ]
    for jar_path in candidates:
        if not os.path.isfile(jar_path):
            continue
        try:
            with zipfile.ZipFile(jar_path, 'r') as zf:
                for name in (
                    'org/apache/catalina/util/ServerInfo.properties',
                    'META-INF/MANIFEST.MF',
                ):
                    try:
                        data = zf.read(name).decode('utf-8', errors='ignore')
                        ver = parse_version(data)
                        if ver:
                            return ver, jar_path, name
                    except KeyError:
                        continue
        except Exception:
            continue
    return None, None, None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_tomcat_121119.py /path/to/tomcat')
        sys.exit(2)

    catalina_home = sys.argv[1]
    if not os.path.isdir(catalina_home):
        print(f'UNKNOWN - path not found: {catalina_home}')
        sys.exit(2)

    version, source_file, source_member = read_server_info(catalina_home)
    if not version:
        print('UNKNOWN - could not determine Tomcat version from catalina.jar')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in version)
    source_desc = f'{source_file}!{source_member}'

    # Plugin 121119 applies only to Tomcat 7.x before 7.0.70
    if version[0] != 7:
        print(f'PATCHED - detected Apache Tomcat {version_str} at {source_desc}; plugin 121119 targets Tomcat 7.x only')
        sys.exit(0)

    if version < TARGET_FIXED:
        print(f'VULNERABLE - detected Apache Tomcat {version_str} at {source_desc}; affected range is 7.0.0 through 7.0.69')
        sys.exit(1)

    print(f'PATCHED - detected Apache Tomcat {version_str} at {source_desc}; fixed upstream in 7.0.70+')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Tenable Nessus Plugin 121119
2. Apache Tomcat 7 security page
3. NVD CVE-2016-3092
4. OpenCVE CVE-2016-3092
5. Ubuntu CVE-2016-3092
6. Debian Security Tracker CVE-2016-3092
7. Apache Wicket note on CVE-2016-3092
8. CVE record