Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:22019
HistoryJun 14, 2009 - 12:00 a.m.

[SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability

2009-06-1400:00:00
vulners.com
29

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Updated to add additional patches required for 5.5.x and 4.1.x

CVE-2008-5515: Apache Tomcat information disclosure vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to 5.5.27
Tomcat 6.0.0 to 6.0.18
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected

Description:
When using a RequestDispatcher obtained from the Request, the target
path was normalised before the query string was removed. A request that
included a specially crafted request parameter could be used to access
content that would otherwise be protected by a security constraint or by
locating it in under the WEB-INF directory.

Mitigation:
6.0.x users should upgrade to 6.0.20 or apply this patch:
http://svn.apache.org/viewvc?view=rev&revision=734734
5.5.x users should upgrade to 5.5.28 when released or apply these patches:
http://svn.apache.org/viewvc?view=rev&revision=782757
http://svn.apache.org/viewvc?view=rev&revision=783291
4.1.x users should upgrade to 4.1.40 when released or apply these patches:
http://svn.apache.org/viewvc?view=rev&revision=782763
http://svn.apache.org/viewvc?view=rev&revision=783292

Example:
For a page that contains:
<%
request.getRequestDispatcher( "bar.jsp?somepar=someval&par=" +
request.getParameter( "blah" ) ).forward( request, response );
%>

an attacker can use:
http://host/page.jsp?blah=/../WEB-INF/web.xml

Credit:
This issue was discovered by Iida Minehiko, Fujitsu Limited

References:
http://tomcat.apache.org/security.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkovmMwACgkQb7IeiTPGAkNPigCcDBEKxwuBoXnvixbqoqM8CIaN
VKYAni4kHySG2JmbYi1hz4xAGpgm36Gr
=7FT9
-----END PGP SIGNATURE-----

Related for SECURITYVULNS:DOC:22019