Apache Tomcat 7

#!/usr/bin/env bash
# verify_cve_2018_1336.sh
# Checks Apache Tomcat 7 exposure to CVE-2018-1336 (UTF-8 decoder DoS)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_DIR="${1:-}"

ver_ge() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  [ "$1" != "$2" ] && ! ver_ge "$1" "$2"
}

print_result() {
  local state="$1"
  local msg="$2"
  echo "$state: $msg"
  case "$state" in
    PATCHED) exit 0 ;;
    VULNERABLE) exit 1 ;;
    *) exit 2 ;;
  esac
}

check_upstream_version() {
  local v="$1"
  if [[ ! "$v" =~ ^7\.0\.[0-9]+$ ]]; then
    print_result "UNKNOWN" "Detected Tomcat version '$v' is not Tomcat 7.0.x; this script only assesses Tenable plugin 121121 scope."
  fi

  if ver_ge "$v" "7.0.88"; then
    print_result "PATCHED" "Upstream Tomcat version $v is at or above 7.0.88."
  elif ver_ge "$v" "7.0.28" && ver_lt "$v" "7.0.88"; then
    print_result "VULNERABLE" "Upstream Tomcat version $v falls in the affected Tenable range (< 7.0.88)."
  else
    print_result "PATCHED" "Tomcat version $v is below 7.0.28 and outside this plugin's affected range."
  fi
}

get_server_number_from_tree() {
  local base="$1"
  local out=""

  if [[ -x "$base/bin/version.sh" ]]; then
    out="$($base/bin/version.sh 2>/dev/null || true)"
  elif [[ -x "$base/bin/catalina.sh" ]]; then
    out="$($base/bin/catalina.sh version 2>/dev/null || true)"
  elif [[ -r "$base/lib/catalina.jar" ]] && command -v java >/dev/null 2>&1; then
    out="$(java -cp "$base/lib/catalina.jar" org.apache.catalina.util.ServerInfo 2>/dev/null || true)"
  fi

  echo "$out" | awk '/Server number:/ {print $3}' | head -n1
}

check_dpkg() {
  command -v dpkg-query >/dev/null 2>&1 || return 1
  command -v dpkg >/dev/null 2>&1 || return 1

  if dpkg-query -W -f='${Status} ${Version}\n' tomcat7 2>/dev/null | grep -q '^install ok installed '; then
    local pkgver
    pkgver="$(dpkg-query -W -f='${Version}' tomcat7 2>/dev/null)"

    if grep -qi ubuntu /etc/os-release 2>/dev/null; then
      if dpkg --compare-versions "$pkgver" ge '7.0.68-1ubuntu0.4+esm1'; then
        print_result "PATCHED" "Ubuntu tomcat7 package $pkgver includes the CVE-2018-1336 fix or later backport."
      fi
      print_result "UNKNOWN" "Ubuntu tomcat7 package $pkgver detected. Older Ubuntu builds may carry backports; verify against Ubuntu CVE/advisory data if not on ESM-fixed package levels."
    fi

    if grep -qi debian /etc/os-release 2>/dev/null; then
      if dpkg --compare-versions "$pkgver" ge '7.0.56-3+really7.0.88-1'; then
        print_result "PATCHED" "Debian tomcat7 package $pkgver includes the Debian backport fix."
      fi
      print_result "UNKNOWN" "Debian tomcat7 package $pkgver detected below the known Jessie fixed build. Check distro support status and backport history."
    fi

    print_result "UNKNOWN" "tomcat7 package $pkgver detected on a dpkg-based system; unsupported distro-specific packaging needs manual review."
  fi

  return 1
}

check_rpm() {
  command -v rpm >/dev/null 2>&1 || return 1

  if rpm -q tomcat >/dev/null 2>&1; then
    local vr
    vr="$(rpm -q --qf '%{VERSION}-%{RELEASE}' tomcat 2>/dev/null)"

    if grep -qi 'rhel\|red hat' /etc/os-release 2>/dev/null || [[ -f /etc/redhat-release ]]; then
      if ver_ge "$vr" '7.0.76-8.el7_5'; then
        print_result "PATCHED" "RHEL tomcat package $vr is at or above the RHSA-2018:2921 fixed build."
      fi
      print_result "UNKNOWN" "RHEL tomcat package $vr detected below the known fixed build; confirm with `rpm -q --changelog tomcat | grep CVE-2018-1336` or Red Hat advisory mapping."
    fi

    print_result "UNKNOWN" "RPM tomcat package $vr detected on a non-RHEL-identified system; distro backports require local advisory review."
  fi

  return 1
}

main() {
  if [[ -n "$TARGET_DIR" && -d "$TARGET_DIR" ]]; then
    v="$(get_server_number_from_tree "$TARGET_DIR")"
    if [[ -n "$v" ]]; then
      check_upstream_version "$v"
    fi
  fi

  for d in /opt/tomcat /usr/share/tomcat /usr/share/tomcat7 /usr/local/tomcat /var/lib/tomcat7 /usr/local/apache-tomcat*; do
    [[ -d "$d" ]] || continue
    v="$(get_server_number_from_tree "$d")"
    if [[ -n "$v" ]]; then
      check_upstream_version "$v"
    fi
  done

  check_dpkg || true
  check_rpm || true

  print_result "UNKNOWN" "Could not reliably determine Tomcat 7 version or package backport status from this host."
}

main