[Forgot Password]
Login  Register Subscribe

23631

 
 

115083

 
 

97147

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2007-0450

Date: (C)2007-03-16   (M)2017-10-12
 
CVSS Score: 5.0Access Vector: NETWORK
Exploitability Subscore: 10.0Access Complexity: LOW
Impact Subscore: 2.9Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: NONE
 Availability: NONE











Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

Reference:
http://www.securityfocus.com/archive/1/archive/1/462791/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/485938/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
BID-22960
SUNALERT-239312
SREASON-2446
SECUNIA-24732
SECUNIA-25106
BID-25159
SECUNIA-25280
SECUNIA-26235
SECUNIA-26660
SECUNIA-27037
SECUNIA-28365
SECUNIA-30899
SECUNIA-30908
SECUNIA-33668
ADV-2007-0975
ADV-2007-2732
ADV-2007-3087
ADV-2007-3386
ADV-2008-0065
ADV-2008-1979
ADV-2009-0233
APPLE-SA-2007-07-31
GLSA-200705-03
HPSBUX02262
MDKSA-2007:241
RHSA-2007:0327
RHSA-2007:0360
RHSA-2008:0261
SSRT071447
SUSE-SR:2007:005
SUSE-SR:2007:015
http://lists.vmware.com/pipermail/security-announce/2008/000003.html
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://docs.info.apple.com/article.html?artnum=306172
http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.html
http://www.sec-consult.com/287.html
http://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt
tomcat-proxy-directory-traversal(32988)

CPE    26
cpe:/a:apache:tomcat:5.5.3
cpe:/a:apache:tomcat:5.5.2
cpe:/a:apache:tomcat:5.5.5
cpe:/a:apache:tomcat:5.5.4
...
CWE    1
CWE-22

© 2013 SecPod Technologies