Apache Tomcat 7.0.0 < 7.0.65

#!/usr/bin/env bash
# check_cve_2015_5174.sh
# Detects likely exposure to CVE-2015-5174 for Apache Tomcat 7.x
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-${CATALINA_HOME:-}}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/tomcat"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - target path does not exist: $TARGET"
  exit 2
fi

get_version() {
  local base="$1"
  local out=""

  if [[ -x "$base/bin/version.sh" ]]; then
    out=$("$base/bin/version.sh" 2>/dev/null | awk -F': ' '/Server number/ {print $2; exit}')
    if [[ -n "$out" ]]; then
      echo "$out"
      return 0
    fi
  fi

  local jar=""
  for jar in "$base/lib/catalina.jar" "$base/server/lib/catalina.jar"; do
    if [[ -f "$jar" ]]; then
      out=$(unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | awk -F': ' '/Implementation-Version/ {print $2; exit}')
      if [[ -n "$out" ]]; then
        echo "$out"
        return 0
      fi
    fi
  done

  return 1
}

ver=$(get_version "$TARGET") || {
  echo "UNKNOWN - could not determine Tomcat version from $TARGET"
  exit 2
}

ver=$(echo "$ver" | tr -d '\r' | xargs)

# Distro/backport hinting: raw upstream comparison is unsafe when suffixes are present.
if [[ "$ver" =~ [+-] || "$ver" =~ (deb|el|ubuntu|redhat|amzn|suse|dfsg) ]]; then
  echo "UNKNOWN - version '$ver' looks distro-packaged/backported; verify package advisory instead"
  exit 2
fi

if [[ ! "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "UNKNOWN - unrecognized version format: $ver"
  exit 2
fi

IFS='.' read -r major minor patch <<< "$ver"

# This check is scoped to Tomcat 7.x because the finding presented is Tenable plugin 121117.
if [[ "$major" != "7" ]]; then
  echo "UNKNOWN - detected Tomcat $ver; this script is scoped to Tomcat 7.x"
  exit 2
fi

if (( minor != 0 )); then
  echo "UNKNOWN - unexpected Tomcat 7 minor version format: $ver"
  exit 2
fi

if (( patch < 65 )); then
  echo "VULNERABLE - Tomcat version $ver is earlier than 7.0.65"
  exit 1
else
  echo "PATCHED - Tomcat version $ver is 7.0.65 or later"
  exit 0
fi