ID CVE-2008-2938
Summary Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
References
Vulnerable Configurations
  • Apache Software Foundation Tomcat 6.0.0
    cpe:2.3:a:apache:tomcat:6.0.0
  • Apache Software Foundation Tomcat 6.0.1
    cpe:2.3:a:apache:tomcat:6.0.1
  • Apache Software Foundation Tomcat 6.0.2
    cpe:2.3:a:apache:tomcat:6.0.2
  • Apache Software Foundation Tomcat 6.0.3
    cpe:2.3:a:apache:tomcat:6.0.3
  • Apache Software Foundation Tomcat 6.0.4
    cpe:2.3:a:apache:tomcat:6.0.4
  • Apache Software Foundation Tomcat 6.0.5
    cpe:2.3:a:apache:tomcat:6.0.5
  • Apache Software Foundation Tomcat 6.0.6
    cpe:2.3:a:apache:tomcat:6.0.6
  • Apache Software Foundation Tomcat 6.0.7
    cpe:2.3:a:apache:tomcat:6.0.7
  • Apache Software Foundation Tomcat 6.0.8
    cpe:2.3:a:apache:tomcat:6.0.8
  • Apache Software Foundation Tomcat 6.0.9
    cpe:2.3:a:apache:tomcat:6.0.9
  • Apache Software Foundation Tomcat 6.0.10
    cpe:2.3:a:apache:tomcat:6.0.10
  • Apache Software Foundation Tomcat 6.0.11
    cpe:2.3:a:apache:tomcat:6.0.11
  • Apache Software Foundation Tomcat 6.0.12
    cpe:2.3:a:apache:tomcat:6.0.12
  • Apache Software Foundation Tomcat 6.0.13
    cpe:2.3:a:apache:tomcat:6.0.13
  • Apache Software Foundation Tomcat 6.0.14
    cpe:2.3:a:apache:tomcat:6.0.14
  • Apache Software Foundation Tomcat 6.0.15
    cpe:2.3:a:apache:tomcat:6.0.15
  • cpe:2.3:a:apache_software_foundation:tomcat:6.0.16
    cpe:2.3:a:apache_software_foundation:tomcat:6.0.16
CVSS
Base: 4.3 (as of 13-08-2008 - 11:50)
Impact:
Exploitability:
CWE CWE-22
CAPEC
  • Relative Path Traversal
    An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
  • Directory Traversal
    An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.
  • File System Function Injection, Content Based
    An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic
    This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
  • Using Escaped Slashes in Alternate Encoding
    This attack targets the use of the backslash in alternate encoding. An attacker can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the attacker tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.
  • Using Slashes in Alternate Encoding
    This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
d2sec via4
name Apache Tomcat File Disclosure
url http://www.d2sec.com/exploits/apache_tomcat_file_disclosure.html
exploit-db via4
  • description Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability. CVE-2008-2938. Remote exploits for multiple platform
    file exploits/multiple/remote/6229.txt
    id EDB-ID:6229
    last seen 2016-02-01
    modified 2008-08-11
    platform multiple
    port
    published 2008-08-11
    reporter Simon Ryeo
    source https://www.exploit-db.com/download/6229/
    title apache tomcat < 6.0.18 utf8 - Directory Traversal Vulnerability
    type remote
  • description Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability. CVE-2008-2938. Remote exploit for unix platform
    id EDB-ID:14489
    last seen 2016-02-01
    modified 2010-07-28
    published 2010-07-28
    reporter mywisdom
    source https://www.exploit-db.com/download/14489/
    title Apache Tomcat < 6.0.18 utf8 - Directory Traversal Vulnerability
metasploit via4
  • description This module tests whether a directory traversal vulnerability is present in versions of Apache Tomcat 4.1.0 - 4.1.37, 5.5.0 - 5.5.26 and 6.0.0 \- 6.0.16 under specific and non-default installations. The connector must have allowLinking set to true and URIEncoding set to UTF-8. Furthermore, the vulnerability actually occurs within Java and not Tomcat; the server must use Java versions prior to Sun 1.4.2_19, 1.5.0_17, 6u11 - or prior IBM Java 5.0 SR9, 1.4.2 SR13, SE 6 SR4 releases. This module has only been tested against RedHat 9 running Tomcat 6.0.16 and Sun JRE 1.5.0-05. You may wish to change FILE (hosts,sensitive files), MAXDIRS and RPORT depending on your environment.
    id MSF:AUXILIARY/ADMIN/HTTP/TOMCAT_UTF8_TRAVERSAL
    last seen 2018-10-19
    modified 2018-10-18
    published 2010-08-23
    reliability Normal
    reporter Rapid7
    source https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb
    title Tomcat UTF-8 Directory Traversal Vulnerability
  • description This module tests whether a directory traversal vulnerablity is present in Trend Micro DLP (Data Loss Prevention) Appliance v5.5 build <= 1294. The vulnerability appears to be actually caused by the Tomcat UTF-8 bug which is implemented in module tomcat_utf8_traversal CVE 2008-2938. This module simply tests for the same bug with Trend Micro specific settings. Note that in the Trend Micro appliance, /etc/shadow is not used and therefore password hashes are stored and anonymously accessible in the passwd file.
    id MSF:AUXILIARY/ADMIN/HTTP/TRENDMICRO_DLP_TRAVERSAL
    last seen 2019-03-31
    modified 2017-11-08
    published 2011-09-22
    reliability Normal
    reporter Rapid7
    source https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb
    title TrendMicro Data Loss Prevention 5.5 Directory Traversal
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_0_TOMCAT6-080821.NASL
    description This update of tomcat fixes another directory traversal bug which occurs when allowLinking and UTF-8 are enabled. (CVE-2008-2938)
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 40143
    published 2009-07-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40143
    title openSUSE Security Update : tomcat6 (tomcat6-161)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_TOMCAT55-5547.NASL
    description This update of tomcat fixes another directory traversal bug which occurs when allowLinking and UTF-8 are enabled. (CVE-2008-2938)
    last seen 2019-02-21
    modified 2015-01-13
    plugin id 34168
    published 2008-09-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34168
    title openSUSE 10 Security Update : tomcat55 (tomcat55-5547)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_TOMCAT5-5539.NASL
    description This update of tomcat fixes another directory traversal bug which occurs when allowLinking and UTF-8 are enabled. (CVE-2008-2938)
    last seen 2019-02-21
    modified 2015-01-13
    plugin id 34154
    published 2008-09-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34154
    title SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 5539)
  • NASL family SuSE Local Security Checks
    NASL id SUSE9_12232.NASL
    description This update of tomcat fixes another directory traversal bug which occurs when allowLinking and UTF-8 are enabled. (CVE-2008-2938)
    last seen 2019-02-21
    modified 2015-01-13
    plugin id 41238
    published 2009-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=41238
    title SuSE9 Security Update : Tomcat (YOU Patch Number 12232)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_TOMCAT5-5542.NASL
    description This update of tomcat fixes another directory traversal bug which occurs when allowLinking and UTF-8 are enabled. (CVE-2008-2938)
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 34155
    published 2008-09-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34155
    title openSUSE 10 Security Update : tomcat5 (tomcat5-5542)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2008-007.NASL
    description The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. This security update contains fixes for the following products : - Apache - Certificates - ClamAV - ColorSync - CUPS - Finder - launchd - libxslt - MySQL Server - Networking - PHP - Postfix - PSNormalizer - QuickLook - rlogin - Script Editor - Single Sign-On - Tomcat - vim - Weblog
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 34374
    published 2008-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34374
    title Mac OS X Multiple Vulnerabilities (Security Update 2008-007)
  • NASL family CGI abuses
    NASL id TOMCAT_UTF8_DIR_TRAVERSAL.NASL
    description The version of Apache Tomcat running on the remote host is affected by a directory traversal vulnerability due to an issue with the UTF-8 charset implementation within the underlying JVM. An unauthenticated, remote attacker can exploit this, by encoding directory traversal sequences as UTF-8 in a request, to view arbitrary files on the remote host. Note that successful exploitation requires that a context be configured with 'allowLinking' set to 'true' and the connector with 'URIEncoding' set to 'UTF-8', neither of which is a default setting.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 33866
    published 2008-08-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=33866
    title Apache Tomcat allowLinking UTF-8 Traversal Arbitrary File Access
  • NASL family SuSE Local Security Checks
    NASL id SUSE_WEBSPHERE-AS_CE-5850.NASL
    description Websphere has been updated to version 2.1.0.1 to fix several security vulnerabilities in the included subprojects, such as Apache Geronimo and Tomcat. (CVE-2007-0184 / CVE-2007-0185 / CVE-2007-2377 / CVE-2007-2449 / CVE-2007-2450 / CVE-2007-3382 / CVE-2007-3385 / CVE-2007-3386 / CVE-2007-5333 / CVE-2007-5342 / CVE-2007-5461 / CVE-2007-5613 / CVE-2007-5615 / CVE-2007-6286 / CVE-2008-0002 / CVE-2008-1232 / CVE-2008-1947 / CVE-2008-2370 / CVE-2008-2938)
    last seen 2019-02-21
    modified 2016-12-22
    plugin id 41596
    published 2009-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=41596
    title SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 5850)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2008-188.NASL
    description A number of vulnerabilities have been discovered in the Apache Tomcat server : The default catalina.policy in the JULI logging component did not restrict certain permissions for web applications which could allow a remote attacker to modify logging configuration options and overwrite arbitrary files (CVE-2007-5342). A cross-site scripting vulnerability was found in the HttpServletResponse.sendError() method which could allow a remote attacker to inject arbitrary web script or HTML via forged HTTP headers (CVE-2008-1232). A cross-site scripting vulnerability was found in the host manager application that could allow a remote attacker to inject arbitrary web script or HTML via the hostname parameter (CVE-2008-1947). A traversal vulnerability was found when using a RequestDispatcher in combination with a servlet or JSP that could allow a remote attacker to utilize a specially crafted request parameter to access protected web resources (CVE-2008-2370). A traversal vulnerability was found when the 'allowLinking' and 'URIencoding' settings were actived which could allow a remote attacker to use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process (CVE-2008-2938). The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 36926
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36926
    title Mandriva Linux Security Advisory : tomcat5 (MDVSA-2008:188)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2008-8113.NASL
    description - Mon Sep 15 2008 David Walluck 0:5.5.27-0jpp.2 - add commons-io symlink - Mon Sep 15 2008 David Walluck 0:5.5.27-0jpp.1 - 5.5.27 Resolves: rhbz#456120 Resolves: rhbz#457934 Resolves: rhbz#446393 Resolves: rhbz#457597 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 34226
    published 2008-09-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34226
    title Fedora 9 : tomcat5-5.5.27-0jpp.2.fc9 (2008-8113)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2008-0648.NASL
    description From Red Hat Security Advisory 2008:0648 : Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232) An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947) A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. (CVE-2008-2938) Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 67733
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67733
    title Oracle Linux 5 : tomcat (ELSA-2008-0648)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0648.NASL
    description Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232) An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947) A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. (CVE-2008-2938) Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 34057
    published 2008-08-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34057
    title RHEL 5 : tomcat (RHSA-2008:0648)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2008-0648.NASL
    description Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232) An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947) A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. (CVE-2008-2938) Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 43703
    published 2010-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43703
    title CentOS 5 : tomcat5 (CESA-2008:0648)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-1007.NASL
    description Updated tomcat packages that fix multiple security issues are now available for Red Hat Network Satellite Server. This update has been rated as having low security impact by the Red Hat Security Response Team. This update corrects several security vulnerabilities in the Tomcat component shipped as part of Red Hat Network Satellite Server. In a typical operating environment, Tomcat is not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. Multiple flaws were fixed in the Apache Tomcat package. (CVE-2008-1232, CVE-2008-1947, CVE-2008-2370, CVE-2008-2938, CVE-2008-3271) Users of Red Hat Network Satellite Server 5.0 or 5.1 are advised to update to these Tomcat packages which resolve these issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 43842
    published 2010-01-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43842
    title RHEL 4 : tomcat in Satellite Server (RHSA-2008:1007)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2008-7977.NASL
    description This release fixes several security-related issues. In addition, this release fixes several user-reported problems related to the startup scripts and file layout. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 34185
    published 2008-09-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34185
    title Fedora 9 : tomcat6-6.0.18-1.1.fc9 (2008-7977)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20080827_TOMCAT_ON_SL5_X.NASL
    description A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232) An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947) A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. (CVE-2008-2938)
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 60470
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60470
    title Scientific Linux Security Update : tomcat on SL5.x i386/x86_64
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2008-8130.NASL
    description - Mon Sep 15 2008 David Walluck 0:5.5.27-0jpp.2 - add commons-io symlink - Mon Sep 15 2008 David Walluck 0:5.5.27-0jpp.1 - 5.5.27 Resolves: rhbz#456120 Resolves: rhbz#457934 Resolves: rhbz#446393 Resolves: rhbz#457597 - Tue Feb 12 2008 Devrim GUNDUZ 0:5.5.26-1jpp.2 - Rebuilt - Fri Feb 8 2008 Devrim GUNDUZ 0:5.5.26-1jpp.1 - Update to new upstream version, which also fixes the following : - CVE-2007-5342 - CVE-2007-5333 - CVE-2007-5461 - CVE-2007-6286 - Removed patch20, now in upstream. - Sat Jan 5 2008 Devrim GUNDUZ 0:5.5.25-2jpp.2 - Fix for bz #153187 - Fix init script for bz #380921 - Fix tomcat5.conf and spec file for bz #253605 - Fix for bz #426850 - Fix for bz #312561 - Fix init script, per bz #247077 - Fix builds on alpha, per bz #253827 - Thu Nov 15 2007 Devrim GUNDUZ 0:5.5.25-1jpp.1 - Updated to 5.5.25, to fix the following issues : - CVE-2007-1355 - CVE-2007-3386 - CVE-2007-3385 - CVE-2007-3382 - CVE-2007-2450, RH bugzilla #244808, #244810, #244812, #363081 - CVE-2007-2449, RH bugzilla #244810, #244812, #244804, #363081 - Applied patch(20) for RH bugzilla #333791, CVE-2007-5461 - Applied patch(21) for RH bugzilla #244803, #244812, #363081, CVE-2007-1358 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 34227
    published 2008-09-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=34227
    title Fedora 8 : tomcat5-5.5.27-0jpp.2.fc8 (2008-8130)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0877.NASL
    description An updated jbossweb package that fixes various security issues is now available for JBoss Enterprise Application Platform (JBoss EAP) 4.2 and 4.3. This update has been rated as having important security impact by the Red Hat Security Response Team. JBoss Web Server (jbossweb) is an enterprise ready web server designed for medium and large applications, is based on Apache Tomcat, and is embedded into JBoss Application Server. It provides organizations with a single deployment platform for JavaServer Pages (JSP) and Java Servlet technologies, Microsoft(r) .NET, PHP, and CGI. A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the jbossweb process. (CVE-2008-2938) Users of jbossweb should upgrade to this updated package, which contains backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 63868
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63868
    title RHEL 4 / 5 : jbossweb (RHSA-2008:0877)
oval via4
accepted 2013-04-29T04:06:53.827-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
family unix
id oval:org.mitre.oval:def:10587
status accepted
submitted 2010-07-09T03:56:16-04:00
title Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
version 18
packetstorm via4
redhat via4
advisories
  • bugzilla
    id 457934
    title CVE-2008-2370 tomcat RequestDispatcher information disclosure vulnerability
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648002
        • comment tomcat5 is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327003
      • AND
        • comment tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648008
        • comment tomcat5-admin-webapps is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327015
      • AND
        • comment tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648022
        • comment tomcat5-common-lib is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327017
      • AND
        • comment tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648006
        • comment tomcat5-jasper is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327009
      • AND
        • comment tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648014
        • comment tomcat5-jasper-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327021
      • AND
        • comment tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648010
        • comment tomcat5-jsp-2.0-api is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327013
      • AND
        • comment tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648012
        • comment tomcat5-jsp-2.0-api-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327023
      • AND
        • comment tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648018
        • comment tomcat5-server-lib is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327007
      • AND
        • comment tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648004
        • comment tomcat5-servlet-2.4-api is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327005
      • AND
        • comment tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648016
        • comment tomcat5-servlet-2.4-api-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327011
      • AND
        • comment tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_2.1
          oval oval:com.redhat.rhsa:tst:20080648020
        • comment tomcat5-webapps is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327019
    rhsa
    id RHSA-2008:0648
    released 2008-08-27
    severity Important
    title RHSA-2008:0648: tomcat security update (Important)
  • rhsa
    id RHSA-2008:0862
  • rhsa
    id RHSA-2008:0864
rpms
  • tomcat5-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-admin-webapps-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-common-lib-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-jasper-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-jasper-javadoc-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-jsp-2.0-api-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-server-lib-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-servlet-2.4-api-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.7.el5_2.1
  • tomcat5-webapps-0:5.5.23-0jpp.7.el5_2.1
refmap via4
apple APPLE-SA-2008-10-09
bid
  • 30633
  • 31681
bugtraq
  • 20080811 Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability
  • 20091107 ToutVirtual VirtualIQ Multiple Vulnerabilities
cert-vn VU#343355
confirm
exploit-db 6229
fedora
  • FEDORA-2008-7977
  • FEDORA-2008-8113
  • FEDORA-2008-8130
hp
  • HPSBUX02401
  • SSRT090005
mandriva MDVSA-2008:188
misc http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
mlist
  • [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
sectrack 1020665
secunia
  • 31639
  • 31865
  • 31891
  • 31982
  • 32120
  • 32222
  • 32266
  • 33797
  • 37297
sreason 4148
suse
  • SUSE-SR:2008:018
  • SUSE-SR:2009:004
vupen
  • ADV-2008-2343
  • ADV-2008-2780
  • ADV-2008-2823
  • ADV-2009-0320
xf tomcat-allowlinking-utf8-directory-traversal(44411)
Last major update 07-03-2011 - 22:09
Published 12-08-2008 - 20:41
Last modified 25-03-2019 - 07:30
Back to Top