Vulnerabilities > CVE-2009-2693 - Path Traversal vulnerability in Apache Tomcat

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Relative Path Traversal
    An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
  • Directory Traversal
    An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.
  • File System Function Injection, Content Based
    An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic
    This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_TOMCAT5-6841.NASL
    description This update of tomcat5/6 fixes: CVE-2009-2693: CVSS v2 Base Score: 5.8 CVE-2009-2902: CVSS v2 Base Score: 4.3 Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. CVE-2009-2901: CVSS v2 Base Score: 4.3 When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
    last seen2020-06-01
    modified2020-06-02
    plugin id45472
    published2010-04-09
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45472
    titleSuSE Security Update: Security update for Tomcat 5 (tomcat5-6841)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    include("compat.inc");
    
    if ( ! defined_func("bn_random") ) exit(0);
    
    if(description)
    {
      script_id(45472);
      script_version ("1.7");
      script_cvs_date("Date: 2019/10/25 13:36:40");
    
      script_cve_id("CVE-2009-2693", "CVE-2009-2901", "CVE-2009-2902");
    
      script_name(english: "SuSE Security Update:  Security update for Tomcat 5 (tomcat5-6841)");
    
      script_set_attribute(attribute: "synopsis", value:
    "The remote SuSE system is missing the security patch tomcat5-6841");
      script_set_attribute(attribute: "description", value: "
    This update of tomcat5/6 fixes:
    
    
    
     CVE-2009-2693: CVSS v2 Base Score: 5.8
      CVE-2009-2902: CVSS v2 Base Score: 4.3
      Directory traversal vulnerability allowed remote attackers
      to create or overwrite arbitrary files/dirs with a specially crafted
      WAR file.
     CVE-2009-2901: CVSS v2 Base Score: 4.3
      When autoDeploy is enabled the autodeployment process deployed
      appBase files that remain from a failed undeploy, which might allow
      remote attackers to bypass intended authentication requirements
      via HTTP requests.
    
    
    ");
      script_set_attribute(attribute: "solution", value: "Install the security patch tomcat5-6841");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2009-2693");
      script_cwe_id(22, 264);
    
      script_set_attribute(attribute:"plugin_publication_date", value: "2010/04/09");
    
      script_set_attribute(attribute:"plugin_type",value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:10");
      script_set_attribute(attribute:"p-cpe", value:"cpe:/a:novell:suse_linux:tomcat5");
      script_set_attribute(attribute:"p-cpe", value:"cpe:/a:novell:suse_linux:tomcat5-admin-webapps");
      script_set_attribute(attribute:"p-cpe", value:"cpe:/a:novell:suse_linux:tomcat5-webapps");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english: "SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/SuSE/rpm-list");
      exit(0);
    }
    
    include("rpm.inc");
    
    if ( ! get_kb_item("Host/SuSE/rpm-list") ) exit(1, "Could not gather the list of packages");
    
    if ( rpm_check( reference:"tomcat5-5.0.30-27.42", release:"SLES10") )
    {
    	security_warning(port:0, extra:rpm_report_get());
    	exit(0);
    }
    if ( rpm_check( reference:"tomcat5-admin-webapps-5.0.30-27.42", release:"SLES10") )
    {
    	security_warning(port:0, extra:rpm_report_get());
    	exit(0);
    }
    if ( rpm_check( reference:"tomcat5-webapps-5.0.30-27.42", release:"SLES10") )
    {
    	security_warning(port:0, extra:rpm_report_get());
    	exit(0);
    }
    # END OF TEST
    exit(0,"Host is not affected");
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100802_TOMCAT5_ON_SL5_X.NASL
    descriptionA flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the
    last seen2020-06-01
    modified2020-06-02
    plugin id60828
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60828
    titleScientific Linux Security Update : tomcat5 on SL5.x i386/x86_64
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201206-24.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Apache Tomcat. Please review the CVE identifiers referenced below for details. Impact : The vulnerabilities allow an attacker to cause a Denial of Service, to hijack a session, to bypass authentication, to inject webscript, to enumerate valid usernames, to read, modify and overwrite arbitrary files, to bypass intended access restrictions, to delete work-directory files, to discover the server’s hostname or IP, to bypass read permissions for files or HTTP headers, to read or write files outside of the intended working directory, and to obtain sensitive information by reading a log file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id59677
    published2012-06-25
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59677
    titleGLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_TOMCAT6-100216.NASL
    descriptionThis update of tomcat5/6 fixes : - CVE-2009-2693: CVSS v2 Base Score: 5.8 CVE-2009-2902: CVSS v2 Base Score: 4.3 Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. - CVE-2009-2901: CVSS v2 Base Score: 4.3 When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. - CVE-2008-5515: CVSS v2 Base Score: 5.0 When using the RequestDispatcher method, i was possible for remote attackers to bypass intended access restrictions and conduct directory traversal attacks.
    last seen2020-06-01
    modified2020-06-02
    plugin id45456
    published2010-04-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45456
    titleopenSUSE Security Update : tomcat6 (tomcat6-2000)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_TOMCAT6-100211.NASL
    descriptionThis update of tomcat5/6 fixes : - CVE-2009-2693: CVSS v2 Base Score: 5.8 CVE-2009-2902: CVSS v2 Base Score: 4.3 Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. - CVE-2009-2901: CVSS v2 Base Score: 4.3 When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. - CVE-2008-5515: CVSS v2 Base Score: 5.0 When using the RequestDispatcher method, i was possible for remote attackers to bypass intended access restrictions and conduct directory traversal attacks.
    last seen2020-06-01
    modified2020-06-02
    plugin id45462
    published2010-04-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45462
    titleopenSUSE Security Update : tomcat6 (tomcat6-2000)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_TOMCAT5-6839.NASL
    descriptionThis update of tomcat5/6 fixes : - Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. CVE-2009-2901: CVSS v2 Base Score: 4.3 When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. (CVE-2009-2693: CVSS v2 Base Score: 5.8). (CVE-2009-2902: CVSS v2 Base Score: 4.3)
    last seen2020-06-01
    modified2020-06-02
    plugin id49929
    published2010-10-11
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49929
    titleSuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 6839)
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2011-0003.NASL
    descriptiona. vCenter Server and vCenter Update Manager update Microsoft SQL Server 2005 Express Edition to Service Pack 3 Microsoft SQL Server 2005 Express Edition (SQL Express) distributed with vCenter Server 4.1 Update 1 and vCenter Update Manager 4.1 Update 1 is upgraded from SQL Express Service Pack 2 to SQL Express Service Pack 3, to address multiple security issues that exist in the earlier releases of Microsoft SQL Express. Customers using other database solutions need not update for these issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086, CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL Express Service Pack 3. b. vCenter Apache Tomcat Management Application Credential Disclosure The Apache Tomcat Manager application configuration file contains logon credentials that can be read by unprivileged local users. The issue is resolved by removing the Manager application in vCenter 4.1 Update 1. If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon credentials are not present in the configuration file after the update. VMware would like to thank Claudio Criscione of Secure Networking for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2010-2928 to this issue. c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version 1.6.0_21 Oracle (Sun) JRE update to version 1.6.0_21, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0850. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following name to the security issue fixed in Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886. d. vCenter Update Manager Oracle (Sun) JRE is updated to version 1.5.0_26 Oracle (Sun) JRE update to version 1.5.0_26, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566, CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573, CVE-2010-3565,CVE-2010-3568, CVE-2010-3569, CVE-2009-3555, CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562, CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572, CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541, CVE-2010-3574. e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28 Apache Tomcat updated to version 6.0.28, which addresses multiple security issues that existed in earlier releases of Apache Tomcat The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i and CVE-2009-3548. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157. f. vCenter Server third-party component OpenSSL updated to version 0.9.8n The version of the OpenSSL library in vCenter Server is updated to 0.9.8n. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0740 and CVE-2010-0433 to the issues addressed in this version of OpenSSL. g. ESX third-party component OpenSSL updated to version 0.9.8p The version of the ESX OpenSSL library is updated to 0.9.8p. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3864 and CVE-2010-2939 to the issues addressed in this update. h. ESXi third-party component cURL updated The version of cURL library in ESXi is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to the issues addressed in this update. i. ESX third-party component pam_krb5 updated The version of pam_krb5 library is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-3825 and CVE-2009-1384 to the issues addressed in the update. j. ESX third-party update for Service Console kernel The Service Console kernel is updated to include kernel version 2.6.18-194.11.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070, CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524, CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086, CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437, CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and CVE-2010-3081 to the issues addressed in the update. Notes : - The update also addresses the 64-bit compatibility mode stack pointer underflow issue identified by CVE-2010-3081. This issue was patched in an ESX 4.1 patch prior to the release of ESX 4.1 Update 1 and in a previous ESX 4.0 patch release. - The update also addresses CVE-2010-2240 for ESX 4.0.
    last seen2020-06-01
    modified2020-06-02
    plugin id51971
    published2011-02-14
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51971
    titleVMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-899-1.NASL
    descriptionIt was discovered that Tomcat did not correctly validate WAR filenames or paths when deploying. A remote attacker could send a specially crafted WAR file to be deployed and cause arbitrary files and directories to be created, overwritten, or deleted. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id44594
    published2010-02-12
    reporterUbuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44594
    titleUbuntu 8.10 / 9.04 / 9.10 : tomcat6 vulnerabilities (USN-899-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12585.NASL
    descriptionThis update of tomcat5/6 fixes : - CVSS v2 Base Score: 5.8. (CVE-2009-2693) - CVSS v2 Base Score: 4.3 Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. (CVE-2009-2902) - CVSS v2 Base Score: 4.3 When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. (CVE-2009-2901) - CVSS v2 Base Score: 5.0 When using the RequestDispatcher method, i was possible for remote attackers to bypass intended access restrictions and conduct directory traversal attacks. (CVE-2008-5515)
    last seen2020-06-01
    modified2020-06-02
    plugin id45452
    published2010-04-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45452
    titleSuSE9 Security Update : Tomcat (YOU Patch Number 12585)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_TOMCAT6-100210.NASL
    descriptionThis update of tomcat5/6 fixes : - CVE-2009-2693: CVSS v2 Base Score: 5.8 CVE-2009-2902: CVSS v2 Base Score: 4.3 Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. - CVE-2009-2901: CVSS v2 Base Score: 4.3 When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. - CVE-2008-5515: CVSS v2 Base Score: 5.0 When using the RequestDispatcher method, i was possible for remote attackers to bypass intended access restrictions and conduct directory traversal attacks.
    last seen2020-06-01
    modified2020-06-02
    plugin id45468
    published2010-04-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45468
    titleopenSUSE Security Update : tomcat6 (tomcat6-2000)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2207.NASL
    descriptionVarious vulnerabilities have been discovered in the Tomcat Servlet and JSP engine, resulting in denial of service, cross-site scripting, information disclosure and WAR file traversal. Further details on the individual security issues can be found on the Apache Tomcat 5 vulnerabilities page.
    last seen2020-03-17
    modified2011-03-30
    plugin id53212
    published2011-03-30
    reporterThis script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/53212
    titleDebian DSA-2207-1 : tomcat5.5 - several vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0580.NASL
    descriptionUpdated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the
    last seen2020-06-01
    modified2020-06-02
    plugin id48231
    published2010-08-03
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/48231
    titleRHEL 5 : tomcat5 (RHSA-2010:0580)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2010-177.NASL
    descriptionMultiple vulnerabilities has been found and corrected in tomcat5 : Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693). The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests (CVE-2009-2901). Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename (CVE-2009-2902). Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server
    last seen2020-06-01
    modified2020-06-02
    plugin id49207
    published2010-09-13
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49207
    titleMandriva Linux Security Advisory : tomcat5 (MDVSA-2010:177)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-883.NASL
    description - fix bnc#793394 - bypass of security constraints (CVE-2012-3546) - tomcat-CVE-2012-3546.patch http://svn.apache.org/viewvc?view=revision&revision=1377 892 - fix bnc#793391 - bypass of CSRF prevention filter (CVE-2012-4431) - tomcat-CVE-2012-4431.patch http://svn.apache.org/viewvc?view=revision&revision=1393 088 - document how to protect against slowloris DoS (CVE-2012-5568/bnc#791679) in README.SUSE - fixes bnc#791423 - cnonce tracking weakness (CVE-2012-5885) bnc#791424 - authentication caching weakness (CVE-2012-5886) bnc#791426 - stale nonce weakness (CVE-2012-5887) - tomcat-dont-parse-user-name-twice.patch http://svn.apache.org/viewvc?view=revision&revision=1366 723 - tomcat-CVE-2009-2693-CVE-2009-2901-CVE-2009-2902.patch http://svn.apache.org/viewvc?view=revision&revision=1377 807 - fix bnc#789406: HTTP NIO connector OOM DoS via a request with large headers (CVE-2012-2733) - http://svn.apache.org/viewvc?view=revision&revision=1350301 - fix bnc#779538 - Tomcat7 default current workdir isn
    last seen2020-06-05
    modified2014-06-13
    plugin id74853
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74853
    titleopenSUSE Security Update : tomcat (openSUSE-SU-2012:1701-1)
  • NASL familyMisc.
    NASL idVMWARE_VMSA-2011-0003_REMOTE.NASL
    descriptionThe remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Apache Tomcat - Apache Tomcat Manager - cURL - Java Runtime Environment (JRE) - Kernel - Microsoft SQL Express - OpenSSL - pam_krb5
    last seen2020-06-01
    modified2020-06-02
    plugin id89674
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89674
    titleVMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_6_3.NASL
    descriptionThe remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3. Mac OS X 10.6.3 contains security fixes for the following products : - AFP Server - Apache - CoreAudio - CoreMedia - CoreTypes - CUPS - DesktopServices - Disk Images - Directory Services - Dovecot - Event Monitor - FreeRADIUS - FTP Server - iChat Server - ImageIO - Image RAW - Libsystem - Mail - MySQL - OS Services - Password Server - PHP - Podcast Producer - Preferences - PS Normalizer - QuickTime - Ruby - Server Admin - SMB - Tomcat - Wiki Server - X11
    last seen2020-06-01
    modified2020-06-02
    plugin id45372
    published2010-03-29
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45372
    titleMac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2010-176.NASL
    descriptionMultiple vulnerabilities has been found and corrected in tomcat5 : Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (
    last seen2020-06-01
    modified2020-06-02
    plugin id49206
    published2010-09-13
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49206
    titleMandriva Linux Security Advisory : tomcat5 (MDVSA-2010:176)
  • NASL familyWeb Servers
    NASL idTOMCAT_WAR_DEPLOY_MULTIPLE_VULNERABILITIES.NASL
    descriptionAccording to its self-reported version number, the remote host is running a version of Apache Tomcat that is affected by multiple vulnerabilities : - When deploying WAR files, the WAR files are not checked for directory traversal attempts which could allow an attacker to create arbitrary content outside of the web root. (CVE-2009-2693) - By default, Tomcat automatically deploys any directories placed in a host
    last seen2020-03-18
    modified2010-01-26
    plugin id44314
    published2010-01-26
    reporterThis script is Copyright (C) 2010-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44314
    titleApache Tomcat WAR Deployment Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2010-002.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied. This security update contains fixes for the following products : - AppKit - Application Firewall - AFP Server - Apache - ClamAV - CoreTypes - CUPS - curl - Cyrus IMAP - Cyrus SASL - Disk Images - Directory Services - Event Monitor - FreeRADIUS - FTP Server - iChat Server - Image RAW - Libsystem - Mail - Mailman - OS Services - Password Server - perl - PHP - PS Normalizer - Ruby - Server Admin - SMB - Tomcat - unzip - vim - Wiki Server - X11 - xar
    last seen2020-06-01
    modified2020-06-02
    plugin id45373
    published2010-03-29
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45373
    titleMac OS X Multiple Vulnerabilities (Security Update 2010-002)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0580.NASL
    descriptionFrom Red Hat Security Advisory 2010:0580 : Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the
    last seen2020-06-01
    modified2020-06-02
    plugin id68076
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68076
    titleOracle Linux 5 : tomcat5 (ELSA-2010-0580)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0580.NASL
    descriptionUpdated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the
    last seen2020-06-01
    modified2020-06-02
    plugin id48218
    published2010-08-03
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/48218
    titleCentOS 5 : tomcat5 (CESA-2010:0580)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-884.NASL
    description - fix bnc#793394 - bypass of security constraints (CVE-2012-3546) - apache-tomcat-CVE-2012-3546.patch http://svn.apache.org/viewvc?view=revision&revision=1381 035 - fix bnc#793391 - bypass of CSRF prevention filter (CVE-2012-4431) - apache-tomcat-CVE-2012-4431.patch http://svn.apache.org/viewvc?view=revision&revision=1394 456 - document how to protect against slowloris DoS (CVE-2012-5568/bnc#791679) in README.SUSE - fixes bnc#791423 - cnonce tracking weakness (CVE-2012-5885) bnc#791424 - authentication caching weakness (CVE-2012-5886) bnc#791426 - stale nonce weakness (CVE-2012-5887) - apache-tomcat-CVE-2009-2693-CVE-2009-2901-CVE-2009-2902. patch http://svn.apache.org/viewvc?view=revision&revision=1380 829 - fix bnc#789406 - HTTP NIO connector OOM DoS via a request with large headers (CVE-2012-2733) - http://svn.apache.org/viewvc?view=revision&revision=1356208
    last seen2020-06-05
    modified2014-06-13
    plugin id74854
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74854
    titleopenSUSE Security Update : tomcat6 (openSUSE-SU-2012:1700-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_TOMCAT5-7003.NASL
    descriptionThis update of Apache Tomcat 5 fixes the following security issues : A directory traversal vulnerability allows remote attackers to create or overwrite arbitrary files and directories with a specially crafted WAR file (CVE-2009-2693 / CVE-2009-2902). When autoDeploy is enabled, the automatic deployment process deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. (CVE-2009-2901) Note that this is a re-release of the security update to correct a regression. The previous patch caused tomcat to delete files it spuriously associated with a failed undeploy.
    last seen2020-06-01
    modified2020-06-02
    plugin id46170
    published2010-04-28
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46170
    titleSuSE 10 Security Update : tomcat5 (ZYPP Patch Number 7003)

Oval

  • accepted2015-04-20T04:01:10.617-04:00
    classvulnerability
    contributors
    • nameGanesh Manal
      organizationHewlett-Packard
    • nameSushant Kumar Singh
      organizationHewlett-Packard
    • namePrashant Kumar
      organizationHewlett-Packard
    • nameMike Cokus
      organizationThe MITRE Corporation
    descriptionDirectory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
    familyunix
    idoval:org.mitre.oval:def:19355
    statusaccepted
    submitted2013-11-22T11:43:28.000-05:00
    titleHP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities
    version48
  • accepted2015-04-20T04:02:32.798-04:00
    classvulnerability
    contributors
    • nameChandan M C
      organizationHewlett-Packard
    • nameSushant Kumar Singh
      organizationHewlett-Packard
    • nameSushant Kumar Singh
      organizationHewlett-Packard
    • namePrashant Kumar
      organizationHewlett-Packard
    • nameMike Cokus
      organizationThe MITRE Corporation
    descriptionDirectory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
    familyunix
    idoval:org.mitre.oval:def:7017
    statusaccepted
    submitted2010-10-25T11:43:28.000-05:00
    titleHP-UX Running Tomcat Servlet Engine, Remote Increase in Privilege, Arbitrary File Modification
    version47

Redhat

advisories
  • rhsa
    idRHSA-2010:0119
  • rhsa
    idRHSA-2010:0580
  • rhsa
    idRHSA-2010:0582
rpms
  • glassfish-jsf-0:1.2_13-2.ep5.el4
  • glassfish-jsf-0:1.2_13-3.ep5.el5
  • httpd-0:2.2.14-1.2.1.ep5.el5
  • httpd-debuginfo-0:2.2.14-1.2.1.ep5.el5
  • httpd-devel-0:2.2.14-1.2.1.ep5.el5
  • httpd-manual-0:2.2.14-1.2.1.ep5.el5
  • httpd22-0:2.2.14-4.ep5.el4
  • httpd22-apr-0:2.2.14-4.ep5.el4
  • httpd22-apr-devel-0:2.2.14-4.ep5.el4
  • httpd22-apr-util-0:2.2.14-4.ep5.el4
  • httpd22-apr-util-devel-0:2.2.14-4.ep5.el4
  • httpd22-debuginfo-0:2.2.14-4.ep5.el4
  • httpd22-devel-0:2.2.14-4.ep5.el4
  • httpd22-manual-0:2.2.14-4.ep5.el4
  • jakarta-commons-chain-0:1.2-2.1.1.ep5.el5
  • jakarta-commons-chain-0:1.2-2.1.ep5.el4
  • jakarta-commons-digester-0:1.8.1-7.ep5.el4
  • jakarta-commons-io-0:1.4-1.1.ep5.el5
  • jakarta-commons-io-0:1.4-1.ep5.el4
  • jakarta-commons-modeler-0:2.0-3.3.ep5.el4
  • jakarta-commons-validator-0:1.3.1-7.4.ep5.el4
  • jakarta-oro-0:2.0.8-3.1.ep5.el5
  • jakarta-oro-0:2.0.8-3jpp.ep1.3.ep5.el4
  • jboss-javaee-poms-0:5.0.1-2.3.ep5.el4
  • jboss-transaction-1.0.1-api-0:5.0.1-2.3.ep5.el4
  • mod_jk-ap20-0:1.2.28-4.1.ep5.el5
  • mod_jk-ap20-0:1.2.28-4.ep5.el4
  • mod_jk-debuginfo-0:1.2.28-4.1.ep5.el5
  • mod_jk-debuginfo-0:1.2.28-4.ep5.el4
  • mod_jk-manual-0:1.2.28-4.1.ep5.el5
  • mod_jk-manual-0:1.2.28-4.ep5.el4
  • mod_ssl-1:2.2.14-1.2.1.ep5.el5
  • mod_ssl22-1:2.2.14-4.ep5.el4
  • struts12-0:1.2.9-2.ep5.el4
  • struts12-0:1.2.9-2.ep5.el5
  • tomcat-native-0:1.1.19-2.0.1.ep5.el5
  • tomcat-native-0:1.1.19-2.0.ep5.el4
  • tomcat-native-debuginfo-0:1.1.19-2.0.1.ep5.el5
  • tomcat-native-debuginfo-0:1.1.19-2.0.ep5.el4
  • tomcat5-0:5.5.28-7.1.ep5.el5
  • tomcat5-0:5.5.28-7.ep5.el4
  • tomcat5-admin-webapps-0:5.5.28-7.1.ep5.el5
  • tomcat5-admin-webapps-0:5.5.28-7.ep5.el4
  • tomcat5-common-lib-0:5.5.28-7.1.ep5.el5
  • tomcat5-common-lib-0:5.5.28-7.ep5.el4
  • tomcat5-jasper-0:5.5.28-7.1.ep5.el5
  • tomcat5-jasper-0:5.5.28-7.ep5.el4
  • tomcat5-jasper-eclipse-0:5.5.28-7.1.ep5.el5
  • tomcat5-jasper-eclipse-0:5.5.28-7.ep5.el4
  • tomcat5-jasper-javadoc-0:5.5.28-7.1.ep5.el5
  • tomcat5-jasper-javadoc-0:5.5.28-7.ep5.el4
  • tomcat5-jsp-2.0-api-0:5.5.28-7.1.ep5.el5
  • tomcat5-jsp-2.0-api-0:5.5.28-7.ep5.el4
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.28-7.1.ep5.el5
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.28-7.ep5.el4
  • tomcat5-parent-0:5.5.28-7.1.ep5.el5
  • tomcat5-parent-0:5.5.28-7.ep5.el4
  • tomcat5-server-lib-0:5.5.28-7.1.ep5.el5
  • tomcat5-server-lib-0:5.5.28-7.ep5.el4
  • tomcat5-servlet-2.4-api-0:5.5.28-7.1.ep5.el5
  • tomcat5-servlet-2.4-api-0:5.5.28-7.ep5.el4
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.28-7.1.ep5.el5
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.28-7.ep5.el4
  • tomcat5-webapps-0:5.5.28-7.1.ep5.el5
  • tomcat5-webapps-0:5.5.28-7.ep5.el4
  • tomcat6-0:6.0.24-2.1.ep5.el5
  • tomcat6-0:6.0.24-2.ep5.el4
  • tomcat6-admin-webapps-0:6.0.24-2.1.ep5.el5
  • tomcat6-admin-webapps-0:6.0.24-2.ep5.el4
  • tomcat6-docs-webapp-0:6.0.24-2.1.ep5.el5
  • tomcat6-docs-webapp-0:6.0.24-2.ep5.el4
  • tomcat6-el-1.0-api-0:6.0.24-2.1.ep5.el5
  • tomcat6-el-1.0-api-0:6.0.24-2.ep5.el4
  • tomcat6-javadoc-0:6.0.24-2.1.ep5.el5
  • tomcat6-javadoc-0:6.0.24-2.ep5.el4
  • tomcat6-jsp-2.1-api-0:6.0.24-2.1.ep5.el5
  • tomcat6-jsp-2.1-api-0:6.0.24-2.ep5.el4
  • tomcat6-lib-0:6.0.24-2.1.ep5.el5
  • tomcat6-lib-0:6.0.24-2.ep5.el4
  • tomcat6-log4j-0:6.0.24-2.1.ep5.el5
  • tomcat6-log4j-0:6.0.24-2.ep5.el4
  • tomcat6-servlet-2.5-api-0:6.0.24-2.1.ep5.el5
  • tomcat6-servlet-2.5-api-0:6.0.24-2.ep5.el4
  • tomcat6-webapps-0:6.0.24-2.1.ep5.el5
  • tomcat6-webapps-0:6.0.24-2.ep5.el4
  • xerces-j2-0:2.9.1-2.2_patch_01.ep5.el4
  • xml-commons-resolver12-1:1.2-1.1.ep5.el4
  • tomcat5-0:5.5.23-0jpp.9.el5_5
  • tomcat5-admin-webapps-0:5.5.23-0jpp.9.el5_5
  • tomcat5-common-lib-0:5.5.23-0jpp.9.el5_5
  • tomcat5-debuginfo-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jasper-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.el5_5
  • tomcat5-server-lib-0:5.5.23-0jpp.9.el5_5
  • tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.el5_5
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.el5_5
  • tomcat5-webapps-0:5.5.23-0jpp.9.el5_5
  • tomcat5-0:5.5.23-0jpp_4rh.17
  • tomcat5-admin-webapps-0:5.5.23-0jpp_4rh.17
  • tomcat5-common-lib-0:5.5.23-0jpp_4rh.17
  • tomcat5-jasper-0:5.5.23-0jpp_4rh.17
  • tomcat5-jasper-javadoc-0:5.5.23-0jpp_4rh.17
  • tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.17
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp_4rh.17
  • tomcat5-server-lib-0:5.5.23-0jpp_4rh.17
  • tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.17
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp_4rh.17
  • tomcat5-webapps-0:5.5.23-0jpp_4rh.17
  • tomcat5-0:5.5.23-0jpp_4rh.19
  • tomcat5-common-lib-0:5.5.23-0jpp_4rh.19
  • tomcat5-jasper-0:5.5.23-0jpp_4rh.19
  • tomcat5-jsp-2.0-api-0:5.5.23-0jpp_4rh.19
  • tomcat5-server-lib-0:5.5.23-0jpp_4rh.19
  • tomcat5-servlet-2.4-api-0:5.5.23-0jpp_4rh.19

Statements

contributorTomas Hoger
lastmodified2010-03-02
organizationRed Hat
statementRed Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2693 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ This issue has been addressed in JBoss Enterprise Web Server 1.0.1: https://rhn.redhat.com/errata/RHSA-2010-0119.html

References