ID CVE-2010-2227
Summary Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
References
Vulnerable Configurations
  • Apache Software Foundation Tomcat 5.5.0
    cpe:2.3:a:apache:tomcat:5.5.0
  • Apache Software Foundation Tomcat 5.5.1
    cpe:2.3:a:apache:tomcat:5.5.1
  • Apache Software Foundation Tomcat 5.5.2
    cpe:2.3:a:apache:tomcat:5.5.2
  • Apache Software Foundation Tomcat 5.5.3
    cpe:2.3:a:apache:tomcat:5.5.3
  • Apache Software Foundation Tomcat 5.5.4
    cpe:2.3:a:apache:tomcat:5.5.4
  • Apache Software Foundation Tomcat 5.5.5
    cpe:2.3:a:apache:tomcat:5.5.5
  • Apache Software Foundation Tomcat 5.5.6
    cpe:2.3:a:apache:tomcat:5.5.6
  • Apache Software Foundation Tomcat 5.5.7
    cpe:2.3:a:apache:tomcat:5.5.7
  • Apache Software Foundation Tomcat 5.5.8
    cpe:2.3:a:apache:tomcat:5.5.8
  • Apache Software Foundation Tomcat 5.5.9
    cpe:2.3:a:apache:tomcat:5.5.9
  • Apache Software Foundation Tomcat 5.5.10
    cpe:2.3:a:apache:tomcat:5.5.10
  • Apache Software Foundation Tomcat 5.5.11
    cpe:2.3:a:apache:tomcat:5.5.11
  • Apache Software Foundation Tomcat 5.5.12
    cpe:2.3:a:apache:tomcat:5.5.12
  • Apache Software Foundation Tomcat 5.5.13
    cpe:2.3:a:apache:tomcat:5.5.13
  • Apache Software Foundation Tomcat 5.5.14
    cpe:2.3:a:apache:tomcat:5.5.14
  • Apache Software Foundation Tomcat 5.5.15
    cpe:2.3:a:apache:tomcat:5.5.15
  • Apache Software Foundation Tomcat 5.5.16
    cpe:2.3:a:apache:tomcat:5.5.16
  • Apache Software Foundation Tomcat 5.5.17
    cpe:2.3:a:apache:tomcat:5.5.17
  • Apache Software Foundation Tomcat 5.5.18
    cpe:2.3:a:apache:tomcat:5.5.18
  • Apache Software Foundation Tomcat 5.5.19
    cpe:2.3:a:apache:tomcat:5.5.19
  • Apache Software Foundation Tomcat 5.5.20
    cpe:2.3:a:apache:tomcat:5.5.20
  • Apache Software Foundation Tomcat 5.5.21
    cpe:2.3:a:apache:tomcat:5.5.21
  • Apache Software Foundation Tomcat 5.5.22
    cpe:2.3:a:apache:tomcat:5.5.22
  • Apache Software Foundation Tomcat 5.5.23
    cpe:2.3:a:apache:tomcat:5.5.23
  • Apache Software Foundation Tomcat 5.5.24
    cpe:2.3:a:apache:tomcat:5.5.24
  • Apache Software Foundation Tomcat 5.5.25
    cpe:2.3:a:apache:tomcat:5.5.25
  • Apache Software Foundation Tomcat 5.5.26
    cpe:2.3:a:apache:tomcat:5.5.26
  • Apache Software Foundation Tomcat 5.5.27
    cpe:2.3:a:apache:tomcat:5.5.27
  • Apache Software Foundation Tomcat 5.5.28
    cpe:2.3:a:apache:tomcat:5.5.28
  • Apache Software Foundation Tomcat 5.5.29
    cpe:2.3:a:apache:tomcat:5.5.29
  • Apache Software Foundation Tomcat 6.0.0
    cpe:2.3:a:apache:tomcat:6.0.0
  • Apache Software Foundation Tomcat 6.0.1
    cpe:2.3:a:apache:tomcat:6.0.1
  • Apache Software Foundation Tomcat 6.0.2
    cpe:2.3:a:apache:tomcat:6.0.2
  • Apache Software Foundation Tomcat 6.0.3
    cpe:2.3:a:apache:tomcat:6.0.3
  • Apache Software Foundation Tomcat 6.0.4
    cpe:2.3:a:apache:tomcat:6.0.4
  • Apache Software Foundation Tomcat 6.0.5
    cpe:2.3:a:apache:tomcat:6.0.5
  • Apache Software Foundation Tomcat 6.0.6
    cpe:2.3:a:apache:tomcat:6.0.6
  • Apache Software Foundation Tomcat 6.0.7
    cpe:2.3:a:apache:tomcat:6.0.7
  • Apache Software Foundation Tomcat 6.0.8
    cpe:2.3:a:apache:tomcat:6.0.8
  • Apache Software Foundation Tomcat 6.0.9
    cpe:2.3:a:apache:tomcat:6.0.9
  • Apache Software Foundation Tomcat 6.0.10
    cpe:2.3:a:apache:tomcat:6.0.10
  • Apache Software Foundation Tomcat 6.0.11
    cpe:2.3:a:apache:tomcat:6.0.11
  • Apache Software Foundation Tomcat 6.0.12
    cpe:2.3:a:apache:tomcat:6.0.12
  • Apache Software Foundation Tomcat 6.0.13
    cpe:2.3:a:apache:tomcat:6.0.13
  • Apache Software Foundation Tomcat 6.0.14
    cpe:2.3:a:apache:tomcat:6.0.14
  • Apache Software Foundation Tomcat 6.0.15
    cpe:2.3:a:apache:tomcat:6.0.15
  • Apache Software Foundation Tomcat 6.0.16
    cpe:2.3:a:apache:tomcat:6.0.16
  • Apache Software Foundation Tomcat 6.0.17
    cpe:2.3:a:apache:tomcat:6.0.17
  • Apache Software Foundation Tomcat 6.0.18
    cpe:2.3:a:apache:tomcat:6.0.18
  • Apache Software Foundation Tomcat 6.0.19
    cpe:2.3:a:apache:tomcat:6.0.19
  • Apache Software Foundation Tomcat 6.0.20
    cpe:2.3:a:apache:tomcat:6.0.20
  • Apache Software Foundation Tomcat 6.0.24
    cpe:2.3:a:apache:tomcat:6.0.24
  • Apache Software Foundation Tomcat 6.0.26
    cpe:2.3:a:apache:tomcat:6.0.26
  • Apache Software Foundation Tomcat 6.0.27
    cpe:2.3:a:apache:tomcat:6.0.27
  • Apache Software Foundation Tomcat 7.0.0 beta
    cpe:2.3:a:apache:tomcat:7.0.0:beta
CVSS
Base: 6.4 (as of 13-07-2010 - 18:29)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE PARTIAL
metasploit via4
description Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
id MSF:AUXILIARY/DOS/HTTP/APACHE_TOMCAT_TRANSFER_ENCODING
last seen 2018-09-09
modified 2017-07-24
published 2011-01-25
reliability Normal
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb
title Apache Tomcat Transfer-Encoding Information Disclosure and DoS
nessus via4
  • NASL family Web Servers
    NASL id TOMCAT_6_0_28.NASL
    description According to its self-reported version number, the instance of Apache Tomcat 6.0 listening on the remote host is prior to 6.0.28. It is, therefore, affected by multiple vulnerabilities: - If a web app is configured to use BASIC or DIGEST authentication and the 'realm-name' attribute is not configured in that web app's 'web.xml' file, the remote server's hostname or IP will be included in replies. (CVE-2010-1157) - An error exists in the handling of invalid values in the 'Transfer-Encoding' header of a request. An attacker can exploit this to cause a denial of service or to disclose sensitive information. (CVE-2010-2227) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-09-01
    modified 2018-08-01
    plugin id 48255
    published 2010-08-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=48255
    title Apache Tomcat 6.0 < 6.0.28 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_1_TOMCAT6-100719.NASL
    description This update of tomcat fixes denial of service and information disclosure vulnerabilities which could potentially be exploited by remote attackers to crash tomcat or to obtain sensitive information (CVE-2010-2227, CVE-2010-1157).
    last seen 2018-09-01
    modified 2015-01-13
    plugin id 49258
    published 2010-09-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49258
    title openSUSE Security Update : tomcat6 (openSUSE-SU-2010:0616-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20100802_TOMCAT5_ON_SL5_X.NASL
    description A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696) Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902) Tomcat must be restarted for this update to take effect.
    last seen 2018-09-01
    modified 2016-12-14
    plugin id 60828
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60828
    title Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-16528.NASL
    description Replaces tomcat6-6.0.26-13.fc14 - Resolves rhbz#640686 - Upgrade of tomcat6 wipes out directories - WARNING - Back up all files that need to be preserved before package update or uninstall - WARNING CVE-2010-2227 applied Several Bug fixes : - tomcat user shell - Multiple instances of tomcat not working (not sure this is the right fix). - init script LSB compliance - Update commons libs - no longer commons-xxx-tomcat5 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-01
    modified 2015-10-20
    plugin id 50593
    published 2010-11-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50593
    title Fedora 14 : tomcat6-6.0.26-14.fc14 (2010-16528)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-177.NASL
    description Multiple vulnerabilities has been found and corrected in tomcat5 : Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693). The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests (CVE-2009-2901). Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename (CVE-2009-2902). Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply (CVE-2010-1157). Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with recycling of a buffer. (CVE-2010-2227) Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90 The updated packages have been patched to correct these issues.
    last seen 2018-09-01
    modified 2018-07-19
    plugin id 49207
    published 2010-09-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49207
    title Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:177)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2010-0580.NASL
    description From Red Hat Security Advisory 2010:0580 : Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696) Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902) Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-18
    plugin id 68076
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68076
    title Oracle Linux 5 : tomcat5 (ELSA-2010-0580)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0584.NASL
    description An updated jbossweb package that fixes two security issues is now available for JBoss Enterprise Application Platform 4.2 and 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. JBoss Web is the web container, based on Apache Tomcat, in JBoss Enterprise Application Platform. It provides a single deployment platform for the JavaServer Pages (JSP) and Java Servlet technologies, Microsoft .NET, PHP, and CGI. A flaw was found in the way JBoss Web handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent JBoss Web from sending replies, or cause JBoss Web to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) A possible minor information leak was found in the way JBoss Web generated HTTP BASIC and DIGEST authentication requests. For configurations where a realm name was not specified and JBoss Web was accessed via a proxy, the default generated realm contained the hostname and port used by the proxy to send requests to the JBoss Web server. (CVE-2010-1157) Users of JBoss Web should upgrade to this updated package, which upgrades JBoss Web to version 2.0.0.CP14, and resolves these issues. The JBoss server process must be restarted for this update to take effect.
    last seen 2018-09-02
    modified 2018-07-25
    plugin id 63942
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63942
    title RHEL 4 / 5 : jbossweb (RHSA-2010:0584)
  • NASL family SuSE Local Security Checks
    NASL id SUSE9_12625.NASL
    description This update of tomcat fixes a denial of service vulnerability and two information disclosure flaws which could potentially be exploited by remote attackers to crash tomcat or to obtain sensitive information. (CVE-2010-2227, CVE-2010-1157)
    last seen 2018-09-01
    modified 2015-01-13
    plugin id 49255
    published 2010-09-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49255
    title SuSE9 Security Update : Tomcat (YOU Patch Number 12625)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2010-0580.NASL
    description Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696) Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902) Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-02
    plugin id 48218
    published 2010-08-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=48218
    title CentOS 5 : tomcat5 (CESA-2010:0580)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2011-006.NASL
    description The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied. This update contains numerous security-related fixes for the following components : - Apache - Application Firewall - ATS - BIND - Certificate Trust Policy - CFNetwork - CoreFoundation - CoreMedia - File Systems - IOGraphics - iChat Server - Mailman - MediaKit - PHP - postfix - python - QuickTime - Tomcat - User Documentation - Web Server - X11
    last seen 2018-09-01
    modified 2018-07-14
    plugin id 56481
    published 2011-10-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56481
    title Mac OS X Multiple Vulnerabilities (Security Update 2011-006)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_2_TOMCAT6-100719.NASL
    description This update of tomcat fixes denial of service and information disclosure vulnerabilities which could potentially be exploited by remote attackers to crash tomcat or to obtain sensitive information (CVE-2010-2227, CVE-2010-1157).
    last seen 2018-09-01
    modified 2015-01-13
    plugin id 49259
    published 2010-09-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49259
    title openSUSE Security Update : tomcat6 (openSUSE-SU-2010:0616-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_3_TOMCAT6-100719.NASL
    description This update of tomcat fixes denial of service and information disclosure vulnerabilities which could potentially be exploited by remote attackers to crash tomcat or to obtain sensitive information (CVE-2010-2227, CVE-2010-1157).
    last seen 2018-09-01
    modified 2015-01-13
    plugin id 75759
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75759
    title openSUSE Security Update : tomcat6 (openSUSE-SU-2010:0616-1)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0003.NASL
    description a. vCenter Server and vCenter Update Manager update Microsoft SQL Server 2005 Express Edition to Service Pack 3 Microsoft SQL Server 2005 Express Edition (SQL Express) distributed with vCenter Server 4.1 Update 1 and vCenter Update Manager 4.1 Update 1 is upgraded from SQL Express Service Pack 2 to SQL Express Service Pack 3, to address multiple security issues that exist in the earlier releases of Microsoft SQL Express. Customers using other database solutions need not update for these issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086, CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL Express Service Pack 3. b. vCenter Apache Tomcat Management Application Credential Disclosure The Apache Tomcat Manager application configuration file contains logon credentials that can be read by unprivileged local users. The issue is resolved by removing the Manager application in vCenter 4.1 Update 1. If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon credentials are not present in the configuration file after the update. VMware would like to thank Claudio Criscione of Secure Networking for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2010-2928 to this issue. c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version 1.6.0_21 Oracle (Sun) JRE update to version 1.6.0_21, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0850. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following name to the security issue fixed in Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886. d. vCenter Update Manager Oracle (Sun) JRE is updated to version 1.5.0_26 Oracle (Sun) JRE update to version 1.5.0_26, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566, CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573, CVE-2010-3565,CVE-2010-3568, CVE-2010-3569, CVE-2009-3555, CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562, CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572, CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541, CVE-2010-3574. e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28 Apache Tomcat updated to version 6.0.28, which addresses multiple security issues that existed in earlier releases of Apache Tomcat The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i and CVE-2009-3548. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157. f. vCenter Server third-party component OpenSSL updated to version 0.9.8n The version of the OpenSSL library in vCenter Server is updated to 0.9.8n. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0740 and CVE-2010-0433 to the issues addressed in this version of OpenSSL. g. ESX third-party component OpenSSL updated to version 0.9.8p The version of the ESX OpenSSL library is updated to 0.9.8p. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3864 and CVE-2010-2939 to the issues addressed in this update. h. ESXi third-party component cURL updated The version of cURL library in ESXi is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to the issues addressed in this update. i. ESX third-party component pam_krb5 updated The version of pam_krb5 library is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-3825 and CVE-2009-1384 to the issues addressed in the update. j. ESX third-party update for Service Console kernel The Service Console kernel is updated to include kernel version 2.6.18-194.11.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070, CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524, CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086, CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437, CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and CVE-2010-3081 to the issues addressed in the update. Notes : - The update also addresses the 64-bit compatibility mode stack pointer underflow issue identified by CVE-2010-3081. This issue was patched in an ESX 4.1 patch prior to the release of ESX 4.1 Update 1 and in a previous ESX 4.0 patch release. - The update also addresses CVE-2010-2240 for ESX 4.0.
    last seen 2018-09-02
    modified 2018-08-06
    plugin id 51971
    published 2011-02-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51971
    title VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
  • NASL family SuSE Local Security Checks
    NASL id SUSE_TOMCAT5-7099.NASL
    description This update of tomcat fixes denial of service and information disclosure vulnerabilities which could potentially be exploited by remote attackers to crash tomcat or to obtain sensitive information. (CVE-2010-2227 / CVE-2010-1157)
    last seen 2018-09-01
    modified 2015-01-13
    plugin id 49930
    published 2010-10-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49930
    title SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 7099)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-16248.NASL
    description - Includes security fix for CVE-2010-2227. - Package updated to new upstream version tomcat-6.0.26 - commons-dbcp-tomcat5, commons-collections-tomcat5, and commons-pool-tomcat5 have been dropped in favor of commons-collections, commons-pool, and commons-dbcp - Directory permissions fixed - tomcat user shell fixed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-01
    modified 2018-07-12
    plugin id 50438
    published 2010-11-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50438
    title Fedora 12 : tomcat6-6.0.26-3.fc12 (2010-16248)
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0003_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Apache Tomcat - Apache Tomcat Manager - cURL - Java Runtime Environment (JRE) - Kernel - Microsoft SQL Express - OpenSSL - pam_krb5
    last seen 2018-09-02
    modified 2018-08-06
    plugin id 89674
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89674
    title VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-16270.NASL
    description - Includes security fix for CVE-2010-2227. - commons-dbcp-tomcat5, commons-collections-tomcat5, and commons-pool-tomcat5 have been dropped in favor of jakarta-commons-collections, jakarta-commons-pool, and jakarta-commons-dbcp - Directory permissions fixed - tomcat user shell fixed Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-02
    modified 2018-07-12
    plugin id 50439
    published 2010-11-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50439
    title Fedora 13 : tomcat6-6.0.26-11.fc13 (2010-16270)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2207.NASL
    description Various vulnerabilities have been discovered in the Tomcat Servlet and JSP engine, resulting in denial of service, cross-site scripting, information disclosure and WAR file traversal. Further details on the individual security issues can be found on the Apache Tomcat 5 vulnerabilities page.
    last seen 2018-09-01
    modified 2018-07-09
    plugin id 53212
    published 2011-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53212
    title Debian DSA-2207-1 : tomcat5.5 - several vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0580.NASL
    description Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227) The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696) Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902) Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.
    last seen 2018-09-02
    modified 2018-07-25
    plugin id 48231
    published 2010-08-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=48231
    title RHEL 5 : tomcat5 (RHSA-2010:0580)
  • NASL family Windows
    NASL id HP_SYSTEMS_INSIGHT_MANAGER_700_MULTIPLE_VULNS.NASL
    description The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the following components : - TLS and SSL protocols - Apache Tomcat - Java - Flash Player - BlazeDS/GraniteDS - Adobe LiveCycle - Adobe Flex SDK - Systems Insight Manager
    last seen 2018-09-01
    modified 2018-07-12
    plugin id 59684
    published 2012-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59684
    title HP Systems Insight Manager < 7.0 Multiple Vulnerabilities
  • NASL family Web Servers
    NASL id TOMCAT_TRANSFER_ENCODING.NASL
    description According to its self-reported version number, the Apache Tomcat server listening on the remote host is 5.5.x prior to 5.5.30. It is, therefore, affected by multiple vulnerabilities : - An error in the access restriction on a 'ServletContext' attribute which holds the location of the work directory in Tomcat's SecurityManager. A remote attacker may be able to modify the location of the working directory which then allows improper read and write access to arbitrary files and directories in the context of Tomcat.(CVE-2010-3718) - An error exists in the handling of the 'Transfer-Encoding' header of a client request. This error affects buffer recycling and may lead to the disclosure of sensitive information or allow a denial of service attack to be successful. (CVE-2010-2227) - An error exists in the handling of the '' element in a web application's web.xml file. If the element is missing from the web.xml file and the application is using BASIC or DIGEST authentication, Tomcat will include the server's hostname or IP address in the 'WWW-Authenticate' header of the response. (CVE-2010-1157) Note that Nessus did not actually test for the flaws but instead has relied on the version in Tomcat's banner or error page so this may be a false positive.
    last seen 2018-09-19
    modified 2018-09-17
    plugin id 47749
    published 2010-07-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47749
    title Apache Tomcat 5.5.x < 5.5.30
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-976-1.NASL
    description It was discovered that Tomcat incorrectly handled invalid Transfer-Encoding headers. A remote attacker could send specially crafted requests containing invalid headers to the server and cause a denial of service, or possibly obtain sensitive information from other requests. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-02
    modified 2018-08-06
    plugin id 48757
    published 2010-08-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=48757
    title Ubuntu 9.04 / 9.10 / 10.04 LTS : tomcat6 vulnerability (USN-976-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201206-24.NASL
    description The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Apache Tomcat. Please review the CVE identifiers referenced below for details. Impact : The vulnerabilities allow an attacker to cause a Denial of Service, to hijack a session, to bypass authentication, to inject webscript, to enumerate valid usernames, to read, modify and overwrite arbitrary files, to bypass intended access restrictions, to delete work-directory files, to discover the server’s hostname or IP, to bypass read permissions for files or HTTP headers, to read or write files outside of the intended working directory, and to obtain sensitive information by reading a log file. Workaround : There is no known workaround at this time.
    last seen 2018-09-01
    modified 2018-07-11
    plugin id 59677
    published 2012-06-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59677
    title GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-176.NASL
    description Multiple vulnerabilities has been found and corrected in tomcat5 : Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (') characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385 (CVE-2007-5333). Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request (CVE-2008-5515). Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header (CVE-2009-0033). Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter (CVE-2009-0580). Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application (CVE-2009-0783). Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693). The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests (CVE-2009-2901). Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename (CVE-2009-2902). Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply (CVE-2010-1157). Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with recycling of a buffer. (CVE-2010-2227) Packages for 2008.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90 The updated packages have been patched to correct these issues.
    last seen 2018-09-01
    modified 2018-07-19
    plugin id 49206
    published 2010-09-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=49206
    title Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:176)
oval via4
accepted 2015-04-20T04:00:44.085-04:00
class vulnerability
contributors
  • name Ganesh Manal
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Prashant Kumar
    organization Hewlett-Packard
  • name Mike Cokus
    organization The MITRE Corporation
description Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
family unix
id oval:org.mitre.oval:def:18532
status accepted
submitted 2013-11-22T11:43:28.000-05:00
title HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities
version 44
redhat via4
advisories
  • bugzilla
    id 616717
    title CVE-2009-2696 tomcat: missing fix for CVE-2009-0781
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment tomcat5 is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580002
        • comment tomcat5 is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327003
      • AND
        • comment tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580004
        • comment tomcat5-admin-webapps is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327015
      • AND
        • comment tomcat5-common-lib is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580012
        • comment tomcat5-common-lib is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327017
      • AND
        • comment tomcat5-jasper is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580014
        • comment tomcat5-jasper is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327009
      • AND
        • comment tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580022
        • comment tomcat5-jasper-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327021
      • AND
        • comment tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580006
        • comment tomcat5-jsp-2.0-api is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327013
      • AND
        • comment tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580016
        • comment tomcat5-jsp-2.0-api-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327023
      • AND
        • comment tomcat5-server-lib is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580010
        • comment tomcat5-server-lib is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327007
      • AND
        • comment tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580020
        • comment tomcat5-servlet-2.4-api is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327005
      • AND
        • comment tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580018
        • comment tomcat5-servlet-2.4-api-javadoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327011
      • AND
        • comment tomcat5-webapps is earlier than 0:5.5.23-0jpp.9.el5_5
          oval oval:com.redhat.rhsa:tst:20100580008
        • comment tomcat5-webapps is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070327019
    rhsa
    id RHSA-2010:0580
    released 2010-08-02
    severity Important
    title RHSA-2010:0580: tomcat5 security update (Important)
  • rhsa
    id RHSA-2010:0581
  • rhsa
    id RHSA-2010:0582
  • rhsa
    id RHSA-2010:0583
rpms
  • tomcat5-0:5.5.23-0jpp.9.el5_5
  • tomcat5-admin-webapps-0:5.5.23-0jpp.9.el5_5
  • tomcat5-common-lib-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jasper-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.el5_5
  • tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.el5_5
  • tomcat5-server-lib-0:5.5.23-0jpp.9.el5_5
  • tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.el5_5
  • tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.el5_5
  • tomcat5-webapps-0:5.5.23-0jpp.9.el5_5
refmap via4
apple APPLE-SA-2011-10-12-3
bid 41544
bugtraq
  • 20100709 [SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability
  • 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
confirm
debian DSA-2207
fedora
  • FEDORA-2010-16248
  • FEDORA-2010-16270
hp
  • HPSBST02955
  • HPSBUX02579
  • HPSBUX02860
  • SSRT100203
  • SSRT101146
mandriva
  • MDVSA-2010:176
  • MDVSA-2010:177
sectrack 1024180
secunia
  • 40813
  • 41025
  • 42079
  • 42368
  • 42454
  • 43310
  • 44183
  • 57126
suse SUSE-SR:2010:017
vupen
  • ADV-2010-1986
  • ADV-2010-2868
  • ADV-2010-3056
xf tomcat-transferencoding-dos(60264)
Last major update 16-03-2014 - 00:03
Published 13-07-2010 - 13:30
Last modified 10-10-2018 - 15:59
Back to Top