Apache Tomcat JULI logging weak security
| apache-juli-logging-weak-security (39201) |  Low Risk |
Description:
Apache Tomcat could provide weaker than expected security, caused by the improper restricting of JULI logging configurations by the default security policy. A remote attacker could exploit this weakness using third party Web applications to create or overwrite files on the system with the privileges of Apache Tomcat
Platforms Affected:
- Apache, Tomcat 5.5.10
- Apache, Tomcat 5.5.11
- Apache, Tomcat 5.5.12
- Apache, Tomcat 5.5.13
- Apache, Tomcat 5.5.14
- Apache, Tomcat 5.5.15
- Apache, Tomcat 5.5.16
- Apache, Tomcat 5.5.17
- Apache, Tomcat 5.5.18
- Apache, Tomcat 5.5.19
- Apache, Tomcat 5.5.20
- Apache, Tomcat 5.5.21
- Apache, Tomcat 5.5.22
- Apache, Tomcat 5.5.23
- Apache, Tomcat 5.5.24
- Apache, Tomcat 5.5.25
- Apache, Tomcat 5.5.9
- Apache, Tomcat 6.0
- Apache, Tomcat 6.0.1
- Apache, Tomcat 6.0.10
- Apache, Tomcat 6.0.11
- Apache, Tomcat 6.0.12
- Apache, Tomcat 6.0.13
- Apache, Tomcat 6.0.14
- Apache, Tomcat 6.0.15
- Apache, Tomcat 6.0.2
- Apache, Tomcat 6.0.3
- Apache, Tomcat 6.0.4
- Apache, Tomcat 6.0.5
- Apache, Tomcat 6.0.6
- Apache, Tomcat 6.0.7
- Apache, Tomcat 6.0.8
- Apache, Tomcat 6.0.9
- Debian, Debian Linux 4.0
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.1
- MandrakeSoft, Mandrake Linux 2008.1 X86_64
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux 5
- RedHat, JBoss Enterprise Application Platform 4.2.0 EL4
- RedHat, JBoss Enterprise Application Platform 4.2.0 EL5
- RedHat, JBoss Enterprise Application Platform 4.3.0 EL4
- RedHat, JBoss Enterprise Application Platform 4.3.0 EL5
- RedHat, RHEL Application Server 2
- RedHat, RHEL Developer Suite 3
- VMware, ESX Server 3.5
Remedy:
Apply the patch for this vulnerability, available from the Apache-SVN Repository. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Bypass Security
References:
- Apache-SVN Repository, Revision 606594 at http://svn.apache.org/viewvc?view=rev&revision=606594.
- BugTraq Mailing List, Sun Dec 23 2007 - 13:26:08 CST , [CVE-2007-5342] Apache Tomcat's default security policy is too open at http://archives.neohapsis.com/archives/bugtraq/2007-12/0284.html.
- VMSA-2008-0010, Updated Tomcat and Java JRE packages for VMware ESX 3.5 at http://www.vmware.com/security/advisories/VMSA-2008-0010.html.
- ASA-2008-190: tomcat security update (RHSA-2008-0195)
- BID-27006: Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
- CVE-2007-5342: The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
- DSA-1447: tomcat5.5 -- several vulnerabilities
- FrSIRT/ADV-2008-0013: Apache Tomcat JULI Logging Component Security Bypass Vulnerability
- FrSIRT/ADV-2008-1856: VMware ESX Server Security Update Fixes Multiple Vulnerabilities
- GLSA-200804-10: Tomcat: Multiple vulnerabilities
- MDVSA-2008:188: tomcat5
- RHSA-2008-0042: Moderate: tomcat security update
- RHSA-2008-0195: Moderate: tomcat security update
- RHSA-2008-0831: Low: JBoss Enterprise Application Platform 4.3.0CP02 security update
- RHSA-2008-0832: Low: JBoss Enterprise Application Platform 4.3.0CP02 security update
- RHSA-2008-0833: Low: JBoss Enterprise Application Platform 4.2.0CP04 security update
- RHSA-2008-0834: JBoss Enterprise Application Platform 4.2.0CP04 security update
- RHSA-2008-0862: Important: tomcat security update
- SA28274: Apache Tomcat JULI Logging Component Security Bypass
- SA30676: VMware ESX Server update for Tomcat and Java JRE
Reported:
Dec 23, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net