Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

- fix bnc#793394 - bypass of security constraints     (CVE-2012-3546)

  - apache-tomcat-CVE-2012-3546.patch     http://svn.apache.org/viewvc?view=revision&revision=1381     035

  - fix bnc#793391 - bypass of CSRF prevention filter     (CVE-2012-4431)

  - apache-tomcat-CVE-2012-4431.patch     http://svn.apache.org/viewvc?view=revision&revision=1394     456

  - document how to protect against slowloris DoS     (CVE-2012-5568/bnc#791679) in README.SUSE

  - fixes bnc#791423 - cnonce tracking weakness     (CVE-2012-5885) bnc#791424 - authentication caching     weakness (CVE-2012-5886) bnc#791426 - stale nonce     weakness (CVE-2012-5887)

  -     apache-tomcat-CVE-2009-2693-CVE-2009-2901-CVE-2009-2902.
    patch     http://svn.apache.org/viewvc?view=revision&revision=1380     829

  - fix bnc#789406 - HTTP NIO connector OOM DoS via a     request with large headers (CVE-2012-2733)

  - http://svn.apache.org/viewvc?view=revision&revision=1356208

- fix bnc#793394 - bypass of security constraints     (CVE-2012-3546)

  - tomcat-CVE-2012-3546.patch     http://svn.apache.org/viewvc?view=revision&revision=1377     892

  - fix bnc#793391 - bypass of CSRF prevention filter     (CVE-2012-4431)

  - tomcat-CVE-2012-4431.patch     http://svn.apache.org/viewvc?view=revision&revision=1393     088

  - document how to protect against slowloris DoS     (CVE-2012-5568/bnc#791679) in README.SUSE

  - fixes bnc#791423 - cnonce tracking weakness     (CVE-2012-5885) bnc#791424 - authentication caching     weakness (CVE-2012-5886) bnc#791426 - stale nonce     weakness (CVE-2012-5887)

  - tomcat-dont-parse-user-name-twice.patch     http://svn.apache.org/viewvc?view=revision&revision=1366     723

  - tomcat-CVE-2009-2693-CVE-2009-2901-CVE-2009-2902.patch     http://svn.apache.org/viewvc?view=revision&revision=1377     807

  - fix bnc#789406: HTTP NIO connector OOM DoS via a request     with large headers (CVE-2012-2733)

  - http://svn.apache.org/viewvc?view=revision&revision=1350301

  - fix bnc#779538 - Tomcat7 default current workdir isn't     /usr/share/tomcat

From Red Hat Security Advisory 2010:0580 :

Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227)

The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696)

Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.

A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227)

The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696)

Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902)

Tomcat must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

Various vulnerabilities have been discovered in the Tomcat Servlet and JSP engine, resulting in denial of service, cross-site scripting, information disclosure and WAR file traversal. Further details on the individual security issues can be found on the Apache Tomcat 5 vulnerabilities page.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

This update of tomcat5/6 fixes :

  - Directory traversal vulnerability allowed remote     attackers to create or overwrite arbitrary files/dirs     with a specially crafted WAR file. CVE-2009-2901: CVSS     v2 Base Score: 4.3 When autoDeploy is enabled the     autodeployment process deployed appBase files that     remain from a failed undeploy, which might allow remote     attackers to bypass intended authentication requirements     via HTTP requests. (CVE-2009-2693: CVSS v2 Base Score:
    5.8). (CVE-2009-2902: CVSS v2 Base Score: 4.3)

Multiple vulnerabilities has been found and corrected in tomcat5 :

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693).

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests (CVE-2009-2901).

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename (CVE-2009-2902).

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply (CVE-2010-1157).

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with recycling of a buffer. (CVE-2010-2227)

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Multiple vulnerabilities has been found and corrected in tomcat5 :

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (') characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE:
this issue exists because of an incomplete fix for CVE-2007-3385 (CVE-2007-5333).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request (CVE-2008-5515).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header (CVE-2009-0033).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter (CVE-2009-0580).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application (CVE-2009-0783).

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693).

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests (CVE-2009-2901).

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename (CVE-2009-2902).

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply (CVE-2010-1157).

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with recycling of a buffer. (CVE-2010-2227)

Packages for 2008.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent HTTP requests. (CVE-2010-2227)

The Tomcat security update RHSA-2009:1164 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter. (CVE-2009-2696)

Two directory traversal flaws were found in the Tomcat deployment process. A specially crafted WAR file could, when deployed, cause a file to be created outside of the web root into any directory writable by the Tomcat user, or could lead to the deletion of files in the Tomcat host's work directory. (CVE-2009-2693, CVE-2009-2902)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.

This update of Apache Tomcat 5 fixes the following security issues :

A directory traversal vulnerability allows remote attackers to create or overwrite arbitrary files and directories with a specially crafted WAR file (CVE-2009-2693 / CVE-2009-2902). When autoDeploy is enabled, the automatic deployment process deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
(CVE-2009-2901)

Note that this is a re-release of the security update to correct a regression. The previous patch caused tomcat to delete files it spuriously associated with a failed undeploy.

This update of tomcat5/6 fixes:



 CVE-2009-2693: CVSS v2 Base Score: 5.8   CVE-2009-2902: CVSS v2 Base Score: 4.3   Directory traversal vulnerability allowed remote attackers   to create or overwrite arbitrary files/dirs with a specially crafted   WAR file.
 CVE-2009-2901: CVSS v2 Base Score: 4.3   When autoDeploy is enabled the autodeployment process deployed   appBase files that remain from a failed undeploy, which might allow   remote attackers to bypass intended authentication requirements   via HTTP requests.

This update of tomcat5/6 fixes :

  - CVE-2009-2693: CVSS v2 Base Score: 5.8 CVE-2009-2902:
    CVSS v2 Base Score: 4.3 Directory traversal     vulnerability allowed remote attackers to create or     overwrite arbitrary files/dirs with a specially crafted     WAR file.

  - CVE-2009-2901: CVSS v2 Base Score: 4.3 When autoDeploy     is enabled the autodeployment process deployed appBase     files that remain from a failed undeploy, which might     allow remote attackers to bypass intended authentication     requirements via HTTP requests.

  - CVE-2008-5515: CVSS v2 Base Score: 5.0 When using the     RequestDispatcher method, i was possible for remote     attackers to bypass intended access restrictions and     conduct directory traversal attacks.

This update of tomcat5/6 fixes :

  - CVSS v2 Base Score: 5.8. (CVE-2009-2693)

  - CVSS v2 Base Score: 4.3 Directory traversal     vulnerability allowed remote attackers to create or     overwrite arbitrary files/dirs with a specially crafted     WAR file. (CVE-2009-2902)

  - CVSS v2 Base Score: 4.3 When autoDeploy is enabled the     autodeployment process deployed appBase files that     remain from a failed undeploy, which might allow remote     attackers to bypass intended authentication requirements     via HTTP requests. (CVE-2009-2901)

  - CVSS v2 Base Score: 5.0 When using the RequestDispatcher     method, i was possible for remote attackers to bypass     intended access restrictions and conduct directory     traversal attacks. (CVE-2008-5515)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

It was discovered that Tomcat did not correctly validate WAR filenames or paths when deploying. A remote attacker could send a specially crafted WAR file to be deployed and cause arbitrary files and directories to be created, overwritten, or deleted.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote host is running a version of Apache Tomcat that is affected by multiple vulnerabilities :

  - When deploying WAR files, the WAR files are not checked     for directory traversal attempts which could allow an     attacker to create arbitrary content outside of the web     root. (CVE-2009-2693)

  - By default, Tomcat automatically deploys any directories     placed in a host's appBase.  This could lead to files     which are normally protected by one or more security     constraints being deployed without those security     constraints. (CVE-2009-2901)

  - When deploying WAR files, the WAR file names are not     checked for directory traversal attempts which could     allow an attacker to caused the deletion of the current     contents of the host's work directory. (CVE-2009-2902).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is earlier than 5.5.29, or 6.0.24.  Such versions are potentially affected by multiple vulnerabilities : 

  - When deploying WAR files, the WAR files are not checked for directory traversal attempts.  This allows an attacker to create arbitrary content outside of the web root by including entries such as '../../bin/catalina.sh' in the WAR. (CVE-2009-2693)

  - By default, Tomcat automatically deploys any directories placed in a host's appBase.  Depending on circumstances, files normally protected by one or more security constraints may be deployed without those security constraints, making them accessible without authentication. (CVE-2009-2901)

  - When deploying WAR files, the WAR file names are not checked for directory traversal attempts, which could lead to the deletion of arbitrary files in the host's work directory. (CVE-2009-2902)

ID	Name	Product	Family	Severity
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	high
74854	openSUSE Security Update : tomcat6 (openSUSE-SU-2012:1700-1)	Nessus	SuSE Local Security Checks	medium
74853	openSUSE Security Update : tomcat (openSUSE-SU-2012:1701-1)	Nessus	SuSE Local Security Checks	medium
68076	Oracle Linux 5 : tomcat5 (ELSA-2010-0580)	Nessus	Oracle Linux Local Security Checks	medium
60828	Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
53212	Debian DSA-2207-1 : tomcat5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	high
49929	SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 6839)	Nessus	SuSE Local Security Checks	medium
49207	Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:177)	Nessus	Mandriva Local Security Checks	medium
49206	Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:176)	Nessus	Mandriva Local Security Checks	medium
48231	RHEL 5 : tomcat5 (RHSA-2010:0580)	Nessus	Red Hat Local Security Checks	medium
48218	CentOS 5 : tomcat5 (CESA-2010:0580)	Nessus	CentOS Local Security Checks	medium
46170	SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 7003)	Nessus	SuSE Local Security Checks	medium
45472	SuSE Security Update: Security update for Tomcat 5 (tomcat5-6841)	Nessus	SuSE Local Security Checks	medium
45468	openSUSE Security Update : tomcat6 (tomcat6-2000)	Nessus	SuSE Local Security Checks	medium
45462	openSUSE Security Update : tomcat6 (tomcat6-2000)	Nessus	SuSE Local Security Checks	medium
45456	openSUSE Security Update : tomcat6 (tomcat6-2000)	Nessus	SuSE Local Security Checks	medium
45452	SuSE9 Security Update : Tomcat (YOU Patch Number 12585)	Nessus	SuSE Local Security Checks	medium
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
44594	Ubuntu 8.10 / 9.04 / 9.10 : tomcat6 vulnerabilities (USN-899-1)	Nessus	Ubuntu Local Security Checks	medium
44314	Apache Tomcat WAR Deployment Multiple Vulnerabilities	Nessus	Web Servers	medium
800619	Apache Tomcat < 5.5.29 / 6.0.24	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2009-2902

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical

medium

medium

medium