Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.6. It is, therefore, affected by the following vulnerability :

  - A cross-site scripting (XSS) vulnerability exists due     to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker     can exploit this, by convincing a user to click a specially     crafted URL, to execute arbitrary script code in a user's     browser session.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0327 :

Updated tomcat packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and JavaServer Pages technologies.

Tomcat was found to accept multiple content-length headers in a request. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks. (CVE-2005-2090)

Tomcat permitted various characters as path delimiters. If Tomcat was used behind certain proxies and configured to only proxy some contexts, an attacker could construct an HTTP request to work around the context restriction and potentially access non-proxied content.
(CVE-2007-0450)

The implict-objects.jsp file distributed in the examples webapp displayed a number of unfiltered header values. If the JSP examples were accessible, this flaw could allow a remote attacker to perform cross-site scripting attacks. (CVE-2006-7195)

Users should upgrade to these erratum packages which contain an update to Tomcat that resolves these issues. Updated jakarta-commons-modeler packages are also included which correct a bug when used with Tomcat 5.5.23.

According to its self-reported version number, the instance of Apache Tomcat 4.x listening on the remote host is prior to 4.1.36. It is, therefore, affected by the following vulnerabilities :

  - Requests containing multiple 'content-length' headers     are not rejected as invalid. This error can allow     web-cache poisoning, cross-site scripting attacks and     information disclosure. (CVE-2005-2090)

  - An input sanitization error exists that can allow     disclosure of sensitive information via directory     traversal. This vulnerability is exposed when the     server is configured to use the 'Proxy' module.
    (CVE-2007-0450)

  - 'Accept-Language' headers are not validated properly,     which can allow cross-site scripting attacks.
    (CVE-2007-1358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 5.x listening on the remote host is prior to 5.5.21. It is, therefore, affected by the following vulnerabilities :

  - The remote Apache Tomcat install is vulnerable to a     cross-site scripting attack. The client supplied     Accept-Language headers are not validated which allows     an attacker to use a specially crafted URL to inject     arbitrary HTML and script code into the user's browser.
    (CVE-2007-1358)

  - If the remote Apache Tomcat install is configured to use     the SingleSignOn Valve, the JSESSIONIDSSO cookie does     not have the 'secure' attribute set if authentication     takes place over HTTPS. This allows the JSESSIONIDSSO     cookie to be sent to the same server when HTTP content     is requested. (CVE-2008-0128)

  - The remote Apache Tomcat install is affected by an     information disclosure vulnerability. The doRead method     fails to return the proper error code for certain error     conditions, which can cause POST content to be sent to     different, and improper, requests. (CVE-2008-4308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

During an internal security audit, it was discovered that Red Hat Network Satellite Server shipped with an XML-RPC script, manzier.pxt, which had a single hard-coded authentication key. A remote attacker who is able to connect to the Satellite Server XML-RPC service could use this flaw to obtain limited information about Satellite Server users, such as login names, associated email addresses, internal user IDs, and partial information about entitlements. (CVE-2008-2369)

This release also corrects several security vulnerabilities in various components shipped as part of Red Hat Network Satellite Server 5.1. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Apache Tomcat package.
(CVE-2005-4838, CVE-2006-0254, CVE-2007-1355, CVE-2007-1358, CVE-2007-2449, CVE-2007-5461, CVE-2008-0128)

Users of Red Hat Network Satellite Server 5.1 are advised to upgrade to 5.1.1, which resolves these issues.

Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server 4.2. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687, CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

During an internal security review, a cross-site scripting flaw was found that affected the Red Hat Network channel search feature.
(CVE-2007-5961)

This release also corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Two arbitrary code execution flaws were fixed in the OpenMotif package. (CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues.

Updated Tomcat5 packages that fix several security bugs are now available for Fedora Core 8.

This update includes fixes to the following :

  - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450

    - CVE-2007-2449

    - CVE-2007-5461

    - CVE-2007-1358

All users of tomcat are advised to update to these packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Tomcat5 packages that fix several security bugs are now available for Fedora Core 7.

This update includes fixes to the following :

  - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450

    - CVE-2007-2449

    - CVE-2007-5461

    - CVE-2007-1358

All users of tomcat are advised to update to these packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

Apache Project reports :

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.36 stable. This build contains numerous library updates, A small number of bug fixes and two important security fixes.

Updated tomcat packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and JavaServer Pages technologies.

Tomcat was found to accept multiple content-length headers in a request. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks. (CVE-2005-2090)

Tomcat permitted various characters as path delimiters. If Tomcat was used behind certain proxies and configured to only proxy some contexts, an attacker could construct an HTTP request to work around the context restriction and potentially access non-proxied content.
(CVE-2007-0450)

The implict-objects.jsp file distributed in the examples webapp displayed a number of unfiltered header values. If the JSP examples were accessible, this flaw could allow a remote attacker to perform cross-site scripting attacks. (CVE-2006-7195)

Users should upgrade to these erratum packages which contain an update to Tomcat that resolves these issues. Updated jakarta-commons-modeler packages are also included which correct a bug when used with Tomcat 5.5.23.

ID	Name	Product	Family	Severity
121114	Apache Tomcat < 6.0.6 Cross-Site Scripting	Nessus	Web Servers	medium
67487	Oracle Linux 5 : tomcat (ELSA-2007-0327)	Nessus	Oracle Linux Local Security Checks	medium
17726	Apache Tomcat 4.x < 4.1.36 Multiple Vulnerabilities	Nessus	Web Servers	medium
46868	Apache Tomcat 5.x < 5.5.21 Multiple Vulnerabilities	Nessus	Web Servers	medium
43840	RHEL 4 : Satellite Server (RHSA-2008:0630)	Nessus	Red Hat Local Security Checks	medium
43837	RHEL 3 / 4 : Satellite Server (RHSA-2008:0524)	Nessus	Red Hat Local Security Checks	critical
43835	RHEL 4 : Satellite Server (RHSA-2008:0261)	Nessus	Red Hat Local Security Checks	critical
28258	Fedora 8 : tomcat5-5.5.25-1jpp.1.fc8 (2007-3474)	Nessus	Fedora Local Security Checks	medium
28257	Fedora 7 : tomcat5-5.5.25-1jpp.1.fc7 (2007-3456)	Nessus	Fedora Local Security Checks	medium
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
25784	FreeBSD : tomcat -- multiple vulnerabilities (872623af-39ec-11dc-b8cc-000fea449b8a)	Nessus	FreeBSD Local Security Checks	medium
25329	RHEL 5 : tomcat (RHSA-2007:0327)	Nessus	Red Hat Local Security Checks	medium
25223	CentOS 5 : tomcat (CESA-2007:0327)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-1358

low

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

medium

medium

critical

medium

medium

medium