SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
(Red Hat Issues Fix) Tomcat WebDAV Servlet Lets Remote Users View Arbitrary Files
SecurityTracker Alert ID:  1019575
SecurityTracker URL:  http://securitytracker.com/id/1019575
CVE Reference:   CVE-2007-5461   (Links to External Site)
Date:  Mar 11 2008
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.0.0 - 4.0.6, 4.1.0, 5.0.x, 5.5.0 - 5.5.25, 6.0.0 - 6.0.14
Description:   A vulnerability was reported in Tomcat. A remote user can view files on the target system.

If a WebDAV servlet is configured and enabled for write, a remote user can supply a specially crafted request containing a SYSTEM tag to view the contents of arbitrary files on the target system.

eliteb0y reported this vulnerability.

Impact:   A remote user can view the contents of arbitrary files on the target system.
Solution:   Red Hat has released a fix.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2008-0042.html

Vendor URL:  tomcat.apache.org/security-6.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  5

Message History:   This archive entry is a follow-up to the message listed below.
Oct 26 2007 Tomcat WebDAV Servlet Lets Remote Users View Arbitrary Files



 Source Message Contents

Subject:  [RHSA-2008:0042-01] Moderate: tomcat security update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: tomcat security update
Advisory ID:       RHSA-2008:0042-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2008-0042.html
Issue date:        2008-03-11
Keywords:          Security
CVE Names:         CVE-2007-5461 CVE-2007-5342 
=====================================================================

1. Summary:

Updated tomcat packages that fix security issues and bugs are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Tomcat is a servlet container for Java Servlet and JavaServer Pages
technologies.

A directory traversal vulnerability existed in the Apache Tomcat webdav
servlet. In some configurations it allowed remote authenticated users to
read files accessible to the local tomcat process. (CVE-2007-5461)

The default security policy in the JULI logging component did not restrict
access permissions to files. This could be misused by untrusted web
applications to access and write arbitrary files in the context of the
tomcat process. (CVE-2007-5342)

Users of Tomcat should update to these errata packages, which contain
backported patches and are not vulnerable to these issues.

4. Solution:

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bugs fixed (http://bugzilla.redhat.com/):

333791 - CVE-2007-5461 Absolute path traversal Apache Tomcat WEBDAV
427216 - CVE-2007-5342 Apache Tomcat's default security policy is too open

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tomcat5-5.5.23-0jpp.3.0.3.el5_1.src.rpm

i386:
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.i386.rpm

x86_64:
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tomcat5-5.5.23-0jpp.3.0.3.el5_1.src.rpm

i386:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.i386.rpm

x86_64:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/tomcat5-5.5.23-0jpp.3.0.3.el5_1.src.rpm

i386:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.i386.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.i386.rpm

ia64:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.ia64.rpm

ppc:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.ppc.rpm

s390x:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.s390x.rpm

x86_64:
tomcat5-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-common-lib-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-debuginfo-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jasper-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-server-lib-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm
tomcat5-webapps-5.5.23-0jpp.3.0.3.el5_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5342
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFH1mUnXlSAg2UNWIIRAvKoAJ0cJJV5+oPc957ND3fN5gCzOtppVgCaA8H2
wWejo90pJcgiarqAqma/KYA=
=yN0E
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC