ISS X-Force Database: tomcat-requestdispatcher-dir-traversal(44156): Apache Tomcat RequestDispatcher directory traversal

Apache Tomcat RequestDispatcher directory traversal

tomcat-requestdispatcher-dir-traversal (44156)

Medium Risk

Description:

Apache Tomcat could allow a remote attacker to traverse directories on the system, caused by the normalization of the target path prior to removing the query string from the URI when using a RequestDispatcher. An attacker could send a specially-crafted request containing "dot dot" sequences (/../) in the request parameter to read arbitrary files on the system.

*CVSS:

Base Score:	5
Access Vector:	Network
Access Complexity:	Low
Authentication:	None
Confidentiality Impact:	Partial
Integrity Impact:	None
Availability Impact:	None

Temporal Score:	3.7
Exploitability:	Unproven
Remediation Level:	Official-Fix
Report Confidence:	Confirmed

Consequences:

Obtain Information

Remedy:

For Apache 4.1.x and 5.5.x:
Upgrade to the latest version of Tomcat (4.1.SVN or 5.5.SVN or later), available from the Apache Tomcat Security Web site. See References.

For Apache 6.0.x:
Upgrade to the latest version of Tomcat (6.0.18 or later), available from the Apache Tomcat Web site. See References.

For other distributions:
Apply the appropriate update for your system. See References.

References:

Apache Tomcat Security Web site: Apache Tomcat 5.x vulnerabilities, Fixed in Apache Tomcat 5.5.SVN.
Apache Tomcat Security Web site: Apache Tomcat 6.x vulnerabilities, Fixed in Apache Tomcat 6.0.18.
Apache Tomcat Security Web site: Apache Tomcat 4.x vulnerabilities, Will not be fixed in Apache Tomcat 4.1.x .
Apache Tomcat Web site: Tomcat 6 Downloads.
Apple Web site: About Security Update 2008-007 .
BugTraq Mailing List, Fri Aug 01 2008 - 09:06:33 CDT: [CVE-2008-2370] Apache Tomcat information disclosure vulnerability.
Fujitsu Web site: Interstage Application Server: Information Disclosure Vulnerabilities(CVE-2008-2370/CVE-2008-5515).
HPSBUX02401 SSRT090005 rev.1: HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of Arbitrary Code, Cross-Site Request Forgery (CSRF).
Novell Document ID: 7006398: Tomcat 5.0.28 in ZLM 7.3 subject to "Multiple Vendor Multiple HTTP Request Smuggling Vulnerabilities".
Security-announce Mailing List, Mon Feb 23 18:39:14 PST 2009: VMSA-2009-0002 VirtualCenter Update 4 updates Tomcat to 5.5.27.
Sun Alert ID: 251986: Security Vulnerabilities in Tomcat 5.5 may Lead to Cross Site Scripting (XSS) or Directory Traversal .
ASA-2008-390: tomcat security update (RHSA-2008-0864)
ASA-2008-401: tomcat security update (RHSA-2008-0862)
ASA-2009-061: HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server SuiteRemote Denial of Service (DoS) Cross-site Scripting (XSS) Execution of Arbitrary Code Cross-Site Request Forgery (CSRF)
ASA-2009-077: Security Vulnerabilities in Tomcat 5.5 may Lead to Cross Site Scripting (XSS) or Directory Traversal (Sun 251986)
BID-30494: Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
BID-31681: RETIRED: Apple Mac OS X 2008-007 Multiple Security Vulnerabilities
BID-35263: Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
CVE-2008-2370: Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
MDVSA-2008:188: tomcat5
OSVDB ID: 56903: Apache ODE (Orchestration Director Engine) Process Deployment Web Service Traversal Arbitrary File Manipulation
RHSA-2008-0648: Important: tomcat security update
RHSA-2008-0862: Important: tomcat security update
RHSA-2008-0864: Important: tomcat security update
RHSA-2008-0877: Important: jbossweb security update
RHSA-2008-1007: Low: tomcat security update for Red Hat Network Satellite Server
RHSA-2010-0602: Moderate: Red Hat Certificate System 7.3 security update
SA31379: Apache Tomcat Multiple Vulnerabilities
SA31381: Apache Tomcat 6 Multiple Vulnerabilities
SA32222: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
SA32266: Avaya AES / MX Apache Tomcat Multiple Vulnerabilities
SA34013: VMware Multiple Products Tomcat Vulnerabilities
SA34039: Sun Solaris Tomcat Directory Traversal and Cross-Site Scripting
SA35393: Fujitsu Interstage Products Information Disclosure Vulnerabilities
SA36249: Apache ODE Process Deployment Web Service Directory Traversal
SA37460: VMware Products Update for Multiple Packages
SA40425: Novell ZENworks Linux Management Tomcat Multiple Vulnerabilities
SECTRACK ID: 1020623: Tomcat RequestDispatcher Bug Lets Remote Users Bypass Access Restrictions
SUSE-SR:2008:018: SUSE Security Summary Report
SUSE-SR:2009:004: SUSE Security Summary Report
VUPEN/ADV-2008-2305: Apache Tomcat Cross Site Scripting and Security Bypass Vulnerabilities
VUPEN/ADV-2008-2780: Apple Mac OS X Code Execution and Security Bypass Vulnerabilities
VUPEN/ADV-2008-2823: Avaya Products Tomcat Security Bypass Vulnerabilities
VUPEN/ADV-2009-0320: HP-UX Security Update Fixes Apache Multiple Remote Vulnerabilities
VUPEN/ADV-2009-0503: VMware Products Tomcat Multiple Information Disclosure Vulnerabilities
VUPEN/ADV-2009-1535: Fujitsu Interstage Products Tomcat Information Disclosure Vulnerabilities
VUPEN/ADV-2009-2215: Apache Orchestration Director Engine Information Disclosure Vulnerability
VUPEN/ADV-2009-3316: VMware Products Multiple Code Execution and Security Bypass Issues

Platforms Affected:

Apache Tomcat 4.1.0
Apache Tomcat 4.1.10
Apache Tomcat 4.1.12
Apache Tomcat 4.1.15
Apache Tomcat 4.1.18
Apache Tomcat 4.1.19
Apache Tomcat 4.1.20
Apache Tomcat 4.1.21
Apache Tomcat 4.1.22
Apache Tomcat 4.1.23
Apache Tomcat 4.1.24
Apache Tomcat 4.1.26
Apache Tomcat 4.1.27
Apache Tomcat 4.1.28
Apache Tomcat 4.1.29
Apache Tomcat 4.1.30
Apache Tomcat 4.1.31
Apache Tomcat 4.1.32
Apache Tomcat 4.1.34
Apache Tomcat 4.1.36
Apache Tomcat 4.1.37
Apache Tomcat 6.0.0
Apache Tomcat 6.0.1
Apache Tomcat 6.0.10
Apache Tomcat 6.0.11
Apache Tomcat 6.0.12
Apache Tomcat 6.0.13
Apache Tomcat 6.0.14
Apache Tomcat 6.0.15
Apache Tomcat 6.0.16
Apple Mac OS X Server 10.5
Apple Mac OS X Server 10.5.1
Apple Mac OS X Server 10.5.2
Apple Mac OS X Server 10.5.3
Apple Mac OS X Server 10.5.4
Apple Mac OS X Server 10.5.5
FUJITSU Interstage Application Server Enterprise Ed
FUJITSU Interstage Apworks
FUJITSU Interstage Business Application Server Enterprise Edition
FUJITSU Interstage Job Workload Server
FUJITSU Interstage Studio
HP HP-UX B.11.11
HP HP-UX B.11.23
HP HP-UX B.11.31
MandrakeSoft Mandrake Linux 2008.0 X86_64
MandrakeSoft Mandrake Linux 2008.0
MandrakeSoft Mandrake Linux 2008.1 X86_64
MandrakeSoft Mandrake Linux 2008.1
Novell ZENworks Linux Management 7.3
RedHat Certificate System 7.3
RedHat Enterprise Linux 5 Client Workstation
RedHat Enterprise Linux 5
RedHat Enterprise Linux 5 Client
RedHat Enterprise Linux 5.2.z EUS
RedHat JBoss Enterprise Application Platform 4.2.0 EL5
RedHat JBoss Enterprise Application Platform 4.2.0 EL4
RedHat JBoss Enterprise Application Platform 4.3.0 EL5
RedHat JBoss Enterprise Application Platform 4.3.0 EL4
RedHat Network Satellite Server 5.0
RedHat Network Satellite Server 5.1
RedHat RHEL Application Server 2
RedHat RHEL Developer Suite 3
Sun OpenSolaris build_snv_01 x86
Sun OpenSolaris build_snv_01 SPARC
Sun OpenSolaris build_snv_02 x86
Sun OpenSolaris build_snv_02 SPARC
Sun OpenSolaris build_snv_03 SPARC
Sun OpenSolaris build_snv_03 x86
Sun OpenSolaris build_snv_04 SPARC
Sun OpenSolaris build_snv_04 x86
Sun OpenSolaris build_snv_05 x86
Sun OpenSolaris build_snv_05 SPARC
Sun OpenSolaris build_snv_06 SPARC
Sun OpenSolaris build_snv_06 x86
Sun OpenSolaris build_snv_07 x86
Sun OpenSolaris build_snv_07 SPARC
Sun OpenSolaris build_snv_08 SPARC
Sun OpenSolaris build_snv_08 x86
Sun OpenSolaris build_snv_09 SPARC
Sun OpenSolaris build_snv_09 x86
Sun OpenSolaris build_snv_10 x86
Sun OpenSolaris build_snv_10 SPARC
Sun OpenSolaris build_snv_100 x86
Sun OpenSolaris build_snv_100 SPARC
Sun OpenSolaris build_snv_11 x86
Sun OpenSolaris build_snv_11 SPARC
Sun OpenSolaris build_snv_12 SPARC
Sun OpenSolaris build_snv_12 x86
Sun OpenSolaris build_snv_13 SPARC
Sun OpenSolaris build_snv_13 x86
Sun OpenSolaris build_snv_14 SPARC
Sun OpenSolaris build_snv_14 x86
Sun OpenSolaris build_snv_15 SPARC
Sun OpenSolaris build_snv_15 x86
Sun OpenSolaris build_snv_16 SPARC
Sun OpenSolaris build_snv_16 x86
Sun OpenSolaris build_snv_17 x86
Sun OpenSolaris build_snv_17 SPARC
Sun OpenSolaris build_snv_18 x86
Sun OpenSolaris build_snv_18 SPARC
Sun OpenSolaris build_snv_19 SPARC
Sun OpenSolaris build_snv_19 x86
Sun OpenSolaris build_snv_20 x86
Sun OpenSolaris build_snv_20 SPARC
Sun OpenSolaris build_snv_21 x86
Sun OpenSolaris build_snv_21 SPARC
Sun OpenSolaris build_snv_22 SPARC
Sun OpenSolaris build_snv_22 x86
Sun OpenSolaris build_snv_23 SPARC
Sun OpenSolaris build_snv_23 x86
Sun OpenSolaris build_snv_24 SPARC
Sun OpenSolaris build_snv_24 x86
Sun OpenSolaris build_snv_25 x86
Sun OpenSolaris build_snv_25 SPARC
Sun OpenSolaris build_snv_26 SPARC
Sun OpenSolaris build_snv_26 x86
Sun OpenSolaris build_snv_27 x86
Sun OpenSolaris build_snv_27 SPARC
Sun OpenSolaris build_snv_28 x86
Sun OpenSolaris build_snv_28 SPARC
Sun OpenSolaris build_snv_29 x86
Sun OpenSolaris build_snv_29 SPARC
Sun OpenSolaris build_snv_30 x86
Sun OpenSolaris build_snv_30 SPARC
Sun OpenSolaris build_snv_31 SPARC
Sun OpenSolaris build_snv_31 x86
Sun OpenSolaris build_snv_32 SPARC
Sun OpenSolaris build_snv_32 x86
Sun OpenSolaris build_snv_33 x86
Sun OpenSolaris build_snv_33 SPARC
Sun OpenSolaris build_snv_34 SPARC
Sun OpenSolaris build_snv_34 x86
Sun OpenSolaris build_snv_35 x86
Sun OpenSolaris build_snv_35 SPARC
Sun OpenSolaris build_snv_36 SPARC
Sun OpenSolaris build_snv_36 x86
Sun OpenSolaris build_snv_37 x86
Sun OpenSolaris build_snv_37 SPARC
Sun OpenSolaris build_snv_38 SPARC
Sun OpenSolaris build_snv_38 x86
Sun OpenSolaris build_snv_39 x86
Sun OpenSolaris build_snv_39 SPARC
Sun OpenSolaris build_snv_40 SPARC
Sun OpenSolaris build_snv_40 x86
Sun OpenSolaris build_snv_41 x86
Sun OpenSolaris build_snv_41 SPARC
Sun OpenSolaris build_snv_42 SPARC
Sun OpenSolaris build_snv_42 x86
Sun OpenSolaris build_snv_43 SPARC
Sun OpenSolaris build_snv_43 x86
Sun OpenSolaris build_snv_44 SPARC
Sun OpenSolaris build_snv_44 x86
Sun OpenSolaris build_snv_45 x86
Sun OpenSolaris build_snv_45 SPARC
Sun OpenSolaris build_snv_46 SPARC
Sun OpenSolaris build_snv_46 x86
Sun OpenSolaris build_snv_47 x86
Sun OpenSolaris build_snv_47 SPARC
Sun OpenSolaris build_snv_48 x86
Sun OpenSolaris build_snv_48 SPARC
Sun OpenSolaris build_snv_49 SPARC
Sun OpenSolaris build_snv_49 x86
Sun OpenSolaris build_snv_50 x86
Sun OpenSolaris build_snv_50 SPARC
Sun OpenSolaris build_snv_51 x86
Sun OpenSolaris build_snv_51 SPARC
Sun OpenSolaris build_snv_52 SPARC
Sun OpenSolaris build_snv_52 x86
Sun OpenSolaris build_snv_53 x86
Sun OpenSolaris build_snv_53 SPARC
Sun OpenSolaris build_snv_54 x86
Sun OpenSolaris build_snv_54 SPARC
Sun OpenSolaris build_snv_55 SPARC
Sun OpenSolaris build_snv_55 x86
Sun OpenSolaris build_snv_56 x86
Sun OpenSolaris build_snv_56 SPARC
Sun OpenSolaris build_snv_57 SPARC
Sun OpenSolaris build_snv_57 x86
Sun OpenSolaris build_snv_58 x86
Sun OpenSolaris build_snv_58 SPARC
Sun OpenSolaris build_snv_59 SPARC
Sun OpenSolaris build_snv_59 x86
Sun OpenSolaris build_snv_60 SPARC
Sun OpenSolaris build_snv_60 x86
Sun OpenSolaris build_snv_61 SPARC
Sun OpenSolaris build_snv_61 x86
Sun OpenSolaris build_snv_62 x86
Sun OpenSolaris build_snv_62 SPARC
Sun OpenSolaris build_snv_63 SPARC
Sun OpenSolaris build_snv_63 x86
Sun OpenSolaris build_snv_64 SPARC
Sun OpenSolaris build_snv_64 x86
Sun OpenSolaris build_snv_65 x86
Sun OpenSolaris build_snv_65 SPARC
Sun OpenSolaris build_snv_66 x86
Sun OpenSolaris build_snv_66 SPARC
Sun OpenSolaris build_snv_67 x86
Sun OpenSolaris build_snv_67 SPARC
Sun OpenSolaris build_snv_68 SPARC
Sun OpenSolaris build_snv_68 x86
Sun OpenSolaris build_snv_69 SPARC
Sun OpenSolaris build_snv_69 x86
Sun OpenSolaris build_snv_70 x86
Sun OpenSolaris build_snv_70 SPARC
Sun OpenSolaris build_snv_71 SPARC
Sun OpenSolaris build_snv_71 x86
Sun OpenSolaris build_snv_72 x86
Sun OpenSolaris build_snv_72 SPARC
Sun OpenSolaris build_snv_73 x86
Sun OpenSolaris build_snv_73 SPARC
Sun OpenSolaris build_snv_74 x86
Sun OpenSolaris build_snv_74 SPARC
Sun OpenSolaris build_snv_75 x86
Sun OpenSolaris build_snv_75 SPARC
Sun OpenSolaris build_snv_76 x86
Sun OpenSolaris build_snv_76 SPARC
Sun OpenSolaris build_snv_77 SPARC
Sun OpenSolaris build_snv_77 x86
Sun OpenSolaris build_snv_78 x86
Sun OpenSolaris build_snv_78 SPARC
Sun OpenSolaris build_snv_79 SPARC
Sun OpenSolaris build_snv_79 x86
Sun OpenSolaris build_snv_79b SPARC
Sun OpenSolaris build_snv_79b x86
Sun OpenSolaris build_snv_80 x86
Sun OpenSolaris build_snv_80 SPARC
Sun OpenSolaris build_snv_81 SPARC
Sun OpenSolaris build_snv_81 x86
Sun OpenSolaris build_snv_82 x86
Sun OpenSolaris build_snv_82 SPARC
Sun OpenSolaris build_snv_83 SPARC
Sun OpenSolaris build_snv_83 x86
Sun OpenSolaris build_snv_84 x86
Sun OpenSolaris build_snv_84 SPARC
Sun OpenSolaris build_snv_85 x86
Sun OpenSolaris build_snv_85 SPARC
Sun OpenSolaris build_snv_86 SPARC
Sun OpenSolaris build_snv_86 x86
Sun OpenSolaris build_snv_87 SPARC
Sun OpenSolaris build_snv_87 x86
Sun OpenSolaris build_snv_88 SPARC
Sun OpenSolaris build_snv_88 x86
Sun OpenSolaris build_snv_89 SPARC
Sun OpenSolaris build_snv_89 x86
Sun OpenSolaris build_snv_90 SPARC
Sun OpenSolaris build_snv_90 x86
Sun OpenSolaris build_snv_91 x86
Sun OpenSolaris build_snv_91 SPARC
Sun OpenSolaris build_snv_92 x86
Sun OpenSolaris build_snv_92 SPARC
Sun OpenSolaris build_snv_93 x86
Sun OpenSolaris build_snv_93 SPARC
Sun OpenSolaris build_snv_94 SPARC
Sun OpenSolaris build_snv_94 x86
Sun OpenSolaris build_snv_95 x86
Sun OpenSolaris build_snv_95 SPARC
Sun OpenSolaris build_snv_96 x86
Sun OpenSolaris build_snv_96 SPARC
Sun OpenSolaris build_snv_97 x86
Sun OpenSolaris build_snv_97 SPARC
Sun OpenSolaris build_snv_98 SPARC
Sun OpenSolaris build_snv_98 x86
Sun OpenSolaris build_snv_99 x86
Sun OpenSolaris build_snv_99 SPARC
Sun Solaris 10 SPARC
Sun Solaris 10 x86
Sun Solaris 9 SPARC
Sun Solaris 9 x86
VMware ESX Server 3.0.2
VMware ESX Server 3.0.3
VMware ESX Server 3.5
VMware Server 2.0
VMware VirtualCenter 2.0.2

Reported:

Aug 01, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page

* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

About IBM Internet Security Systems

IBM Internet Security Systems is a trusted security advisor to thousands of the world's leading businesses and governments, helping to provide pre-emptive protection for networks, desktops and servers. The IBM Proventia? integrated security platform is designed to automatically protect against both known and unknown threats, helping to keep networks up and running and shield customers from online attacks before they impact business assets. IBM Internet Security Systems products and services are based on the proactive security intelligence of its X-Force? research and development team ? an unequivocal world authority in vulnerability and threat research. The IBM Internet Security Systems product line is also complemented by comprehensive Managed Security Services and Professional Security Services. For more information, visit the IBM Internet Security Systems Web site at www.iss.net or call 800-776-2362.