Apache Tomcat allowLinking UTF-8 directory traversal
| tomcat-allowlinking-utf8-directory-traversal (44411) |  Medium Risk |
Description:
Apache Tomcat could allow a remote attacker to traverse directories on the system, caused by an error when allowLinking is set to true or URIEncoding is set to UTF-8. An attacker could exploit this vulnerability using a specially-crafted URL request to view arbitrary files on the system.
Platforms Affected:
- Apache, Tomcat 6.0.0
- Apache, Tomcat 6.0.1
- Apache, Tomcat 6.0.10
- Apache, Tomcat 6.0.11
- Apache, Tomcat 6.0.12
- Apache, Tomcat 6.0.13
- Apache, Tomcat 6.0.14
- Apache, Tomcat 6.0.15
- Apache, Tomcat 6.0.16
- Apache, Tomcat 6.0.2
- Apache, Tomcat 6.0.3
- Apache, Tomcat 6.0.4
- Apache, Tomcat 6.0.5
- Apache, Tomcat 6.0.6
- Apache, Tomcat 6.0.7
- Apache, Tomcat 6.0.8
- Apache, Tomcat 6.0.9
- Apple, Mac OS X Server 10.5
- Apple, Mac OS X Server 10.5.1
- Apple, Mac OS X Server 10.5.2
- Apple, Mac OS X Server 10.5.3
- Apple, Mac OS X Server 10.5.4
- Apple, Mac OS X Server 10.5.5
- HP, HP-UX B.11.11
- HP, HP-UX B.11.23
- HP, HP-UX B.11.31
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.1 X86_64
- MandrakeSoft, Mandrake Linux 2008.1
- Oracle, Application Server 10.1.3.1.0
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, JBoss Enterprise Application Platform 4.2.0 EL4
- RedHat, JBoss Enterprise Application Platform 4.2.0 EL5
- RedHat, Network Satellite Server 5.0
- RedHat, Network Satellite Server 5.1
- RedHat, RHEL Application Server 2
- RedHat, RHEL Developer Suite 3
Remedy:
Upgrade to the latest version of Tomcat (6.0.18 or later), available from the Apache Tomcat Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Obtain Information
References:
- Apache Tomcat Security Web site, Fixed in Apache Tomcat 6.0.18 at http://tomcat.apache.org/security-6.html.
- Apache Tomcat Web site, Apache Tomcat 6 Downloads at http://tomcat.apache.org/download-60.cgi.
- Apple Web site, About Security Update 2008-007 at http://support.apple.com/kb/HT3216.
- BugTraq Mailing List, Mon Aug 11 2008 - 03:52:44 CDT, Apache Tomcat <= 6.0.18 UTF8 Directory Traversal Vulnerability at http://archives.neohapsis.com/archives/bugtraq/2008-08/0120.html.
- BugTraq Mailing List, Mon Jan 19 2009 - 22:56:32 CST , Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server 10g (10.1.3.1.0) Oracle HTTP Server at http://archives.neohapsis.com/archives/bugtraq/2009-01/0181.html.
- BugTraq Mailing List, Thu Dec 18 2008 - 10:46:17 CST, [SECURITY] CVE-2008-2938 - Apache Tomcat information disclosure vulnerability - Update 2 at http://archives.neohapsis.com/archives/bugtraq/2008-12/0189.html.
- HPSBUX02401 SSRT090005 rev.1, HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of Arbitrary Code, Cross-Site Request Forgery (CSRF) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01650939.
- ASA-2008-390: tomcat security update (RHSA-2008-0864)
- ASA-2008-401: tomcat security update (RHSA-2008-0862)
- ASA-2009-061: HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server SuiteRemote Denial of Service (DoS) Cross-site Scripting (XSS) Execution of Arbitrary Code Cross-Site Request Forgery (CSRF)
- BID-30633: Multiple Java Runtime Implementations UTF-8 Input Validation Vulnerability
- BID-31681: RETIRED: Apple Mac OS X 2008-007 Multiple Security Vulnerabilities
- CVE-2008-2938: Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
- MDVSA-2008:188: tomcat5
- RHSA-2008-0648: Important: tomcat security update
- RHSA-2008-0862: Important: tomcat security update
- RHSA-2008-0864: Important: tomcat security update
- RHSA-2008-0877: Important: jbossweb security update
- RHSA-2008-1007: Low: tomcat security update for Red Hat Network Satellite Server
- SA32222: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
- SA32266: Avaya AES / MX Apache Tomcat Multiple Vulnerabilities
- SECTRACK ID: 1020665: Tomcat UTF-8 'AllowLinking' Java Bug Lets Remote Users Traverse the Directory
- SUSE-SR:2008:018: SUSE Security Summary Report
- SUSE-SR:2009:004: SUSE Security Summary Report
- US-CERT VU#343355: Apache Tomcat UTF8 Directory Traversal Vulnerability
- VUPEN/ADV-2008-2343: Apache Tomcat UTF-8 Remote Directory Traversal Vulnerability
- VUPEN/ADV-2008-2780: Apple Mac OS X Code Execution and Security Bypass Vulnerabilities
- VUPEN/ADV-2008-2823: Avaya Products Tomcat Security Bypass Vulnerabilities
- VUPEN/ADV-2009-0320: HP-UX Security Update Fixes Apache Multiple Remote Vulnerabilities
Reported:
Aug 11, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net