[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96125

 
 

909

 
 

78020

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

MDVSA-2009:136 -- Mandriva tomcat5

ID: oval:org.secpod.oval:def:300556Date: (C)2012-01-07   (M)2017-10-04
Class: PATCHFamily: unix




Multiple security vulnerabilities has been identified and fixed in tomcat5: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. sequences and the WEB-INF directory in a Request . Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header . Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the MemoryRealm, DataSourceRealm, and JDBCRealm authentication realms, as demonstrated by a % value for the j_password parameter . The calendar application in the examples web application contains an XSS flaw due to invalid HTML which renders the XSS filtering protection ineffective . Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application . The updated packages have been patched to prevent this. Additionally Apache Tomcat has been upgraded to the latest 5.5.27 version for 2009.0.

Platform:
Mandriva Linux 2009.0
Mandriva Linux 2009.1
Product:
tomcat5
Reference:
MDVSA-2009:136
CVE-2009-0781
CVE-2009-0580
CVE-2009-0033
CVE-2008-5515
CVE-2007-6286
CVE-2007-5461
CVE-2009-0783
CVE    7
CVE-2007-6286
CVE-2007-5461
CVE-2008-5515
CVE-2009-0033
...
CPE    20
cpe:/o:mandriva:linux:2009.0
cpe:/a:apache:tomcat:4.1.12
cpe:/a:apache:tomcat:4.1.29
cpe:/a:apache:tomcat:4.1.2
...

© 2013 SecPod Technologies