You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2007/02/17 03:53:57 UTC
svn commit: r508702 - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
Author: markt
Date: Fri Feb 16 18:53:55 2007
New Revision: 508702
URL: http://svn.apache.org/viewvc?view=rev&rev=508702
Log:
Initial commit for the new security pages. Only a few items on the CVE list have been included so far.
Added:
tomcat/site/trunk/docs/security-3.html (with props)
tomcat/site/trunk/docs/security-4.html (with props)
tomcat/site/trunk/docs/security-5.html (with props)
tomcat/site/trunk/docs/security-6.html (with props)
tomcat/site/trunk/docs/security-impact.html (with props)
tomcat/site/trunk/docs/security.html (with props)
tomcat/site/trunk/xdocs/security-3.xml (with props)
tomcat/site/trunk/xdocs/security-4.xml (with props)
tomcat/site/trunk/xdocs/security-5.xml (with props)
tomcat/site/trunk/xdocs/security-6.xml (with props)
tomcat/site/trunk/xdocs/security-impact.xml (with props)
tomcat/site/trunk/xdocs/security.xml (with props)
Modified:
tomcat/site/trunk/docs/bugreport.html
tomcat/site/trunk/docs/contact.html
tomcat/site/trunk/docs/download-33.html
tomcat/site/trunk/docs/download-41.html
tomcat/site/trunk/docs/download-55.html
tomcat/site/trunk/docs/download-connectors.html
tomcat/site/trunk/docs/findhelp.html
tomcat/site/trunk/docs/getinvolved.html
tomcat/site/trunk/docs/heritage.html
tomcat/site/trunk/docs/index.html
tomcat/site/trunk/docs/irc.html
tomcat/site/trunk/docs/legal.html
tomcat/site/trunk/docs/lists.html
tomcat/site/trunk/docs/resources.html
tomcat/site/trunk/docs/svn.html
tomcat/site/trunk/docs/whichversion.html
tomcat/site/trunk/docs/whoweare.html
tomcat/site/trunk/xdocs/stylesheets/project.xml
Modified: tomcat/site/trunk/docs/bugreport.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/bugreport.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/bugreport.html (original)
+++ tomcat/site/trunk/docs/bugreport.html Fri Feb 16 18:53:55 2007
@@ -109,6 +109,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/contact.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/contact.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/contact.html (original)
+++ tomcat/site/trunk/docs/contact.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/download-33.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/download-33.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/download-33.html (original)
+++ tomcat/site/trunk/docs/download-33.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/download-41.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/download-41.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/download-41.html (original)
+++ tomcat/site/trunk/docs/download-41.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/download-55.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/download-55.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/download-55.html (original)
+++ tomcat/site/trunk/docs/download-55.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/download-connectors.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/download-connectors.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/download-connectors.html (original)
+++ tomcat/site/trunk/docs/download-connectors.html Fri Feb 16 18:53:55 2007
@@ -3,16 +3,16 @@
<html>
<head>
<title>Apache Tomcat - Tomcat Connectors (mod_jk, mod_jk2) Downloads</title>
-<link rel="stylesheet" href="stylesheets/tomcat.css" type="text/css" />
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
</head>
-<body vlink="#525D76" alink="#525D76" link="#525D76" text="#000000" bgcolor="#ffffff">
-<table cellspacing="0" width="100%" border="0">
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
<!--PAGE HEADER-->
<tr>
<td>
<!--PROJECT LOGO-->
<a href="http://tomcat.apache.org/">
-<img border="0" alt="Tomcat Logo" align="left" src="./images/tomcat.gif" />
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
</a>
</td>
<td>
@@ -23,28 +23,28 @@
<td>
<!--APACHE LOGO-->
<a href="http://www.apache.org/">
-<img border="0" alt="Apache Logo" align="right" src="http://www.apache.org/images/asf-logo.gif" />
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
</a>
</td>
</tr>
</table>
<div class="searchbox">
-<form method="get" action="http://www.google.com/search">
-<input type="hidden" name="sitesearch" value="tomcat.apache.org" />
-<input type="text" id="query" name="q" size="25" value="Search the Site" />
-<input type="submit" value="Search Site" name="Search" />
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
</form>
</div>
-<table cellspacing="4" width="100%" border="0">
+<table border="0" width="100%" cellspacing="4">
<!--HEADER SEPARATOR-->
<tr>
<td colspan="2">
-<hr size="1" noshade="" />
+<hr noshade="" size="1"/>
</td>
</tr>
<tr>
<!--LEFT SIDE NAVIGATION-->
-<td nowrap="true" valign="top" width="20%">
+<td width="20%" valign="top" nowrap="true">
<p>
<strong>Apache Tomcat</strong>
</p>
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
@@ -161,11 +164,11 @@
</ul>
</td>
<!--RIGHT SIDE MAIN BODY-->
-<td align="left" valign="top" width="80%">
-<table width="100%" cellpadding="2" cellspacing="0" border="0">
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
<tr>
<td bgcolor="#525D76">
-<font face="arial,helvetica,sanserif" color="#ffffff">
+<font color="#ffffff" face="arial,helvetica,sanserif">
<a name="Tomcat Connectors (mod_jk, mod_jk2) Downloads">
<strong>Tomcat Connectors (mod_jk, mod_jk2) Downloads</strong>
</a>
@@ -184,8 +187,8 @@
encounter a problem with this mirror, please select another
mirror. If all mirrors are failing, there are <i>backup</i>
mirrors (at the end of the mirrors list) that should be
- available.<br />[if-any logo]<a href="[link]">
-<img align="right" src="[logo]" border="0" />
+ available.<br/>[if-any logo]<a href="[link]">
+<img align="right" src="[logo]" border="0"/>
</a>[end]</p>
<p>
<form action="[location]" method="get" id="SelectMirror">
@@ -200,7 +203,7 @@
[for backup]<option value="[backup]">[backup] (backup)</option>[end]
[end]
</select>
-<input type="submit" value="Change" />
+<input type="submit" value="Change"/>
</form>
</p>
<p>
@@ -292,7 +295,7 @@
</tr>
<tr>
<td>
-<br />
+<br/>
</td>
</tr>
</table>
@@ -301,14 +304,14 @@
<!--FOOTER SEPARATOR-->
<tr>
<td colspan="2">
-<hr size="1" noshade="" />
+<hr noshade="" size="1"/>
</td>
</tr>
<!--PAGE FOOTER-->
<tr>
<td colspan="2">
<div align="center">
-<font size="-1" color="#525D76">
+<font color="#525D76" size="-1">
<em>
Copyright © 1999-2006, The Apache Software Foundation
</em>
Modified: tomcat/site/trunk/docs/findhelp.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/findhelp.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/findhelp.html (original)
+++ tomcat/site/trunk/docs/findhelp.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/getinvolved.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/getinvolved.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/getinvolved.html (original)
+++ tomcat/site/trunk/docs/getinvolved.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/heritage.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/heritage.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/heritage.html (original)
+++ tomcat/site/trunk/docs/heritage.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/index.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/index.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/index.html (original)
+++ tomcat/site/trunk/docs/index.html Fri Feb 16 18:53:55 2007
@@ -111,6 +111,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/irc.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/irc.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/irc.html (original)
+++ tomcat/site/trunk/docs/irc.html Fri Feb 16 18:53:55 2007
@@ -109,6 +109,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/legal.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/legal.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/legal.html (original)
+++ tomcat/site/trunk/docs/legal.html Fri Feb 16 18:53:55 2007
@@ -109,6 +109,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/lists.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/lists.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/lists.html (original)
+++ tomcat/site/trunk/docs/lists.html Fri Feb 16 18:53:55 2007
@@ -109,6 +109,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/resources.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/resources.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/resources.html (original)
+++ tomcat/site/trunk/docs/resources.html Fri Feb 16 18:53:55 2007
@@ -109,6 +109,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Added: tomcat/site/trunk/docs/security-3.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-3.html?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/docs/security-3.html (added)
+++ tomcat/site/trunk/docs/security-3.html Fri Feb 16 18:53:55 2007
@@ -0,0 +1,254 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<title>Apache Tomcat - Apache Tomcat 3.x vulnerabilities</title>
+<meta name="author" value="Apache Tomcat Project"/>
+<meta name="email" value=""/>
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
+</head>
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
+<!--PAGE HEADER-->
+<tr>
+<td>
+<!--PROJECT LOGO-->
+<a href="http://tomcat.apache.org/">
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
+</a>
+</td>
+<td>
+<font face="arial,helvetica,sanserif">
+<h1>Apache Tomcat</h1>
+</font>
+</td>
+<td>
+<!--APACHE LOGO-->
+<a href="http://www.apache.org/">
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
+</a>
+</td>
+</tr>
+</table>
+<div class="searchbox">
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
+</form>
+</div>
+<table border="0" width="100%" cellspacing="4">
+<!--HEADER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<tr>
+<!--LEFT SIDE NAVIGATION-->
+<td width="20%" valign="top" nowrap="true">
+<p>
+<strong>Apache Tomcat</strong>
+</p>
+<ul>
+<li>
+<a href="./index.html">Home</a>
+</li>
+</ul>
+<p>
+<strong>Download</strong>
+</p>
+<ul>
+<li>
+<a href="./whichversion.html">Which version?</a>
+</li>
+<li>
+<a href="./download-60.cgi">Tomcat 6.x</a>
+</li>
+<li>
+<a href="./download-55.cgi">Tomcat 5.x</a>
+</li>
+<li>
+<a href="./download-41.cgi">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./download-33.cgi">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./download-connectors.cgi">Tomcat Connectors</a>
+</li>
+<li>
+<a href="http://archive.apache.org/dist/tomcat">Archives</a>
+</li>
+</ul>
+<p>
+<strong>Documentation</strong>
+</p>
+<ul>
+<li>
+<a href="./tomcat-6.0-doc/index.html">Tomcat 6.0</a>
+</li>
+<li>
+<a href="./tomcat-5.5-doc/index.html">Tomcat 5.5</a>
+</li>
+<li>
+<a href="./tomcat-5.0-doc/index.html">Tomcat 5.0</a>
+</li>
+<li>
+<a href="./tomcat-4.1-doc/index.html">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./tomcat-3.3-doc/index.html">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./connectors-doc">Tomcat Connectors</a>
+</li>
+</ul>
+<p>
+<strong>Problems?</strong>
+</p>
+<ul>
+<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
+<a href="./findhelp.html">Find help</a>
+</li>
+<li>
+<a href="./faq/">FAQ</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+<li>
+<a href="./bugreport.html">Bug Database</a>
+</li>
+<li>
+<a href="./irc.html">IRC</a>
+</li>
+</ul>
+<p>
+<strong>Get Involved</strong>
+</p>
+<ul>
+<li>
+<a href="./getinvolved.html">Overview</a>
+</li>
+<li>
+<a href="./svn.html">SVN Repositories</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+</ul>
+<p>
+<strong>Misc</strong>
+</p>
+<ul>
+<li>
+<a href="./whoweare.html">Who We Are</a>
+</li>
+<li>
+<a href="./heritage.html">Heritage</a>
+</li>
+<li>
+<a href="http://www.apache.org">Apache Home</a>
+</li>
+<li>
+<a href="./resources.html">Resources</a>
+</li>
+<li>
+<a href="./contact.html">Contact</a>
+</li>
+<li>
+<a href="./legal.html">Legal</a>
+</li>
+</ul>
+</td>
+<!--RIGHT SIDE MAIN BODY-->
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Apache Tomcat 3.x vulnerabilities">
+<strong>Apache Tomcat 3.x vulnerabilities</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 3.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Fixed in Apache Tomcat 3.?.?">
+<strong>Fixed in Apache Tomcat 3.?.?</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+</td>
+</tr>
+<!--FOOTER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<!--PAGE FOOTER-->
+<tr>
+<td colspan="2">
+<div align="center">
+<font color="#525D76" size="-1">
+<em>
+ Copyright © 1999-2006, The Apache Software Foundation
+ </em>
+</font>
+</div>
+</td>
+</tr>
+</table>
+</body>
+</html>
Propchange: tomcat/site/trunk/docs/security-3.html
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/docs/security-4.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-4.html?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/docs/security-4.html (added)
+++ tomcat/site/trunk/docs/security-4.html Fri Feb 16 18:53:55 2007
@@ -0,0 +1,302 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<title>Apache Tomcat - Apache Tomcat 4.x vulnerabilities</title>
+<meta name="author" value="Apache Tomcat Project"/>
+<meta name="email" value=""/>
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
+</head>
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
+<!--PAGE HEADER-->
+<tr>
+<td>
+<!--PROJECT LOGO-->
+<a href="http://tomcat.apache.org/">
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
+</a>
+</td>
+<td>
+<font face="arial,helvetica,sanserif">
+<h1>Apache Tomcat</h1>
+</font>
+</td>
+<td>
+<!--APACHE LOGO-->
+<a href="http://www.apache.org/">
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
+</a>
+</td>
+</tr>
+</table>
+<div class="searchbox">
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
+</form>
+</div>
+<table border="0" width="100%" cellspacing="4">
+<!--HEADER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<tr>
+<!--LEFT SIDE NAVIGATION-->
+<td width="20%" valign="top" nowrap="true">
+<p>
+<strong>Apache Tomcat</strong>
+</p>
+<ul>
+<li>
+<a href="./index.html">Home</a>
+</li>
+</ul>
+<p>
+<strong>Download</strong>
+</p>
+<ul>
+<li>
+<a href="./whichversion.html">Which version?</a>
+</li>
+<li>
+<a href="./download-60.cgi">Tomcat 6.x</a>
+</li>
+<li>
+<a href="./download-55.cgi">Tomcat 5.x</a>
+</li>
+<li>
+<a href="./download-41.cgi">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./download-33.cgi">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./download-connectors.cgi">Tomcat Connectors</a>
+</li>
+<li>
+<a href="http://archive.apache.org/dist/tomcat">Archives</a>
+</li>
+</ul>
+<p>
+<strong>Documentation</strong>
+</p>
+<ul>
+<li>
+<a href="./tomcat-6.0-doc/index.html">Tomcat 6.0</a>
+</li>
+<li>
+<a href="./tomcat-5.5-doc/index.html">Tomcat 5.5</a>
+</li>
+<li>
+<a href="./tomcat-5.0-doc/index.html">Tomcat 5.0</a>
+</li>
+<li>
+<a href="./tomcat-4.1-doc/index.html">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./tomcat-3.3-doc/index.html">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./connectors-doc">Tomcat Connectors</a>
+</li>
+</ul>
+<p>
+<strong>Problems?</strong>
+</p>
+<ul>
+<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
+<a href="./findhelp.html">Find help</a>
+</li>
+<li>
+<a href="./faq/">FAQ</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+<li>
+<a href="./bugreport.html">Bug Database</a>
+</li>
+<li>
+<a href="./irc.html">IRC</a>
+</li>
+</ul>
+<p>
+<strong>Get Involved</strong>
+</p>
+<ul>
+<li>
+<a href="./getinvolved.html">Overview</a>
+</li>
+<li>
+<a href="./svn.html">SVN Repositories</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+</ul>
+<p>
+<strong>Misc</strong>
+</p>
+<ul>
+<li>
+<a href="./whoweare.html">Who We Are</a>
+</li>
+<li>
+<a href="./heritage.html">Heritage</a>
+</li>
+<li>
+<a href="http://www.apache.org">Apache Home</a>
+</li>
+<li>
+<a href="./resources.html">Resources</a>
+</li>
+<li>
+<a href="./contact.html">Contact</a>
+</li>
+<li>
+<a href="./legal.html">Legal</a>
+</li>
+</ul>
+</td>
+<!--RIGHT SIDE MAIN BODY-->
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Apache Tomcat 4.x vulnerabilities">
+<strong>Apache Tomcat 4.x vulnerabilities</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 4.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Fixed in Apache Tomcat 4.1.32">
+<strong>Fixed in Apache Tomcat 4.1.32</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>
+<strong>low: Directory listing</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3835">
+ CVE-2006-3835</a>
+</p>
+
+ <p>This is expected behaviour when directory listings are enabled. The
+ semicolon (;) is the separator for path parameters so inserting one
+ before a file name changes the request into a request for a directory
+ with a path parameter. If directory listings are enabled, a diretcory
+ listing will be shown. In response to this and other directory listing
+ issues, directory listings were changed to be disabled by default.</p>
+
+ <p>Affects: 4.0.0-4.0.6, 4.1.0-4.1.31</p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Unverified">
+<strong>Unverified</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>
+<strong>low: Installation path disclosure</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4703">
+ CVE-2005-4703</a>
+</p>
+ <p>This issue only affects Windows operating systems. It can not be
+ reproduced on Windows XP Home with JDKs 1.3.1, 1.4.2, 1.5.0 or 1.6.0.
+ Further investigation is required to determine the Windows operating
+ system and JDK combinations that do exhibit this issue.</p>
+
+ <p>Affects: 4.0.3?</p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+</td>
+</tr>
+<!--FOOTER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<!--PAGE FOOTER-->
+<tr>
+<td colspan="2">
+<div align="center">
+<font color="#525D76" size="-1">
+<em>
+ Copyright © 1999-2006, The Apache Software Foundation
+ </em>
+</font>
+</div>
+</td>
+</tr>
+</table>
+</body>
+</html>
Propchange: tomcat/site/trunk/docs/security-4.html
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/docs/security-5.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-5.html?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/docs/security-5.html (added)
+++ tomcat/site/trunk/docs/security-5.html Fri Feb 16 18:53:55 2007
@@ -0,0 +1,267 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<title>Apache Tomcat - Apache Tomcat 5.x vulnerabilities</title>
+<meta name="author" value="Apache Tomcat Project"/>
+<meta name="email" value=""/>
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
+</head>
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
+<!--PAGE HEADER-->
+<tr>
+<td>
+<!--PROJECT LOGO-->
+<a href="http://tomcat.apache.org/">
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
+</a>
+</td>
+<td>
+<font face="arial,helvetica,sanserif">
+<h1>Apache Tomcat</h1>
+</font>
+</td>
+<td>
+<!--APACHE LOGO-->
+<a href="http://www.apache.org/">
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
+</a>
+</td>
+</tr>
+</table>
+<div class="searchbox">
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
+</form>
+</div>
+<table border="0" width="100%" cellspacing="4">
+<!--HEADER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<tr>
+<!--LEFT SIDE NAVIGATION-->
+<td width="20%" valign="top" nowrap="true">
+<p>
+<strong>Apache Tomcat</strong>
+</p>
+<ul>
+<li>
+<a href="./index.html">Home</a>
+</li>
+</ul>
+<p>
+<strong>Download</strong>
+</p>
+<ul>
+<li>
+<a href="./whichversion.html">Which version?</a>
+</li>
+<li>
+<a href="./download-60.cgi">Tomcat 6.x</a>
+</li>
+<li>
+<a href="./download-55.cgi">Tomcat 5.x</a>
+</li>
+<li>
+<a href="./download-41.cgi">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./download-33.cgi">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./download-connectors.cgi">Tomcat Connectors</a>
+</li>
+<li>
+<a href="http://archive.apache.org/dist/tomcat">Archives</a>
+</li>
+</ul>
+<p>
+<strong>Documentation</strong>
+</p>
+<ul>
+<li>
+<a href="./tomcat-6.0-doc/index.html">Tomcat 6.0</a>
+</li>
+<li>
+<a href="./tomcat-5.5-doc/index.html">Tomcat 5.5</a>
+</li>
+<li>
+<a href="./tomcat-5.0-doc/index.html">Tomcat 5.0</a>
+</li>
+<li>
+<a href="./tomcat-4.1-doc/index.html">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./tomcat-3.3-doc/index.html">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./connectors-doc">Tomcat Connectors</a>
+</li>
+</ul>
+<p>
+<strong>Problems?</strong>
+</p>
+<ul>
+<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
+<a href="./findhelp.html">Find help</a>
+</li>
+<li>
+<a href="./faq/">FAQ</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+<li>
+<a href="./bugreport.html">Bug Database</a>
+</li>
+<li>
+<a href="./irc.html">IRC</a>
+</li>
+</ul>
+<p>
+<strong>Get Involved</strong>
+</p>
+<ul>
+<li>
+<a href="./getinvolved.html">Overview</a>
+</li>
+<li>
+<a href="./svn.html">SVN Repositories</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+</ul>
+<p>
+<strong>Misc</strong>
+</p>
+<ul>
+<li>
+<a href="./whoweare.html">Who We Are</a>
+</li>
+<li>
+<a href="./heritage.html">Heritage</a>
+</li>
+<li>
+<a href="http://www.apache.org">Apache Home</a>
+</li>
+<li>
+<a href="./resources.html">Resources</a>
+</li>
+<li>
+<a href="./contact.html">Contact</a>
+</li>
+<li>
+<a href="./legal.html">Legal</a>
+</li>
+</ul>
+</td>
+<!--RIGHT SIDE MAIN BODY-->
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Apache Tomcat 5.x vulnerabilities">
+<strong>Apache Tomcat 5.x vulnerabilities</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 5.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Fixed in Apache Tomcat 5.5.13, 5.0.HEAD">
+<strong>Fixed in Apache Tomcat 5.5.13, 5.0.HEAD</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>
+<strong>low: Directory listing</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3835">
+ CVE-2006-3835</a>
+</p>
+
+ <p>This is expected behaviour when directory listings are enabled. The
+ semicolon (;) is the separator for path parameters so inserting one
+ before a file name changes the request into a request for a directory
+ with a path parameter. If directory listings are enabled, a diretcory
+ listing will be shown. In response to this and other directory listing
+ issues, directory listings were changed to be disabled by default.</p>
+
+ <p>Affects: 5.0.0-5.5.30, 5.5.0-5.5.12</p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+</td>
+</tr>
+<!--FOOTER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<!--PAGE FOOTER-->
+<tr>
+<td colspan="2">
+<div align="center">
+<font color="#525D76" size="-1">
+<em>
+ Copyright © 1999-2006, The Apache Software Foundation
+ </em>
+</font>
+</div>
+</td>
+</tr>
+</table>
+</body>
+</html>
Propchange: tomcat/site/trunk/docs/security-5.html
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/docs/security-6.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-6.html?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/docs/security-6.html (added)
+++ tomcat/site/trunk/docs/security-6.html Fri Feb 16 18:53:55 2007
@@ -0,0 +1,254 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<title>Apache Tomcat - Apache Tomcat 6.x vulnerabilities</title>
+<meta name="author" value="Apache Tomcat Project"/>
+<meta name="email" value=""/>
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
+</head>
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
+<!--PAGE HEADER-->
+<tr>
+<td>
+<!--PROJECT LOGO-->
+<a href="http://tomcat.apache.org/">
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
+</a>
+</td>
+<td>
+<font face="arial,helvetica,sanserif">
+<h1>Apache Tomcat</h1>
+</font>
+</td>
+<td>
+<!--APACHE LOGO-->
+<a href="http://www.apache.org/">
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
+</a>
+</td>
+</tr>
+</table>
+<div class="searchbox">
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
+</form>
+</div>
+<table border="0" width="100%" cellspacing="4">
+<!--HEADER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<tr>
+<!--LEFT SIDE NAVIGATION-->
+<td width="20%" valign="top" nowrap="true">
+<p>
+<strong>Apache Tomcat</strong>
+</p>
+<ul>
+<li>
+<a href="./index.html">Home</a>
+</li>
+</ul>
+<p>
+<strong>Download</strong>
+</p>
+<ul>
+<li>
+<a href="./whichversion.html">Which version?</a>
+</li>
+<li>
+<a href="./download-60.cgi">Tomcat 6.x</a>
+</li>
+<li>
+<a href="./download-55.cgi">Tomcat 5.x</a>
+</li>
+<li>
+<a href="./download-41.cgi">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./download-33.cgi">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./download-connectors.cgi">Tomcat Connectors</a>
+</li>
+<li>
+<a href="http://archive.apache.org/dist/tomcat">Archives</a>
+</li>
+</ul>
+<p>
+<strong>Documentation</strong>
+</p>
+<ul>
+<li>
+<a href="./tomcat-6.0-doc/index.html">Tomcat 6.0</a>
+</li>
+<li>
+<a href="./tomcat-5.5-doc/index.html">Tomcat 5.5</a>
+</li>
+<li>
+<a href="./tomcat-5.0-doc/index.html">Tomcat 5.0</a>
+</li>
+<li>
+<a href="./tomcat-4.1-doc/index.html">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./tomcat-3.3-doc/index.html">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./connectors-doc">Tomcat Connectors</a>
+</li>
+</ul>
+<p>
+<strong>Problems?</strong>
+</p>
+<ul>
+<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
+<a href="./findhelp.html">Find help</a>
+</li>
+<li>
+<a href="./faq/">FAQ</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+<li>
+<a href="./bugreport.html">Bug Database</a>
+</li>
+<li>
+<a href="./irc.html">IRC</a>
+</li>
+</ul>
+<p>
+<strong>Get Involved</strong>
+</p>
+<ul>
+<li>
+<a href="./getinvolved.html">Overview</a>
+</li>
+<li>
+<a href="./svn.html">SVN Repositories</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+</ul>
+<p>
+<strong>Misc</strong>
+</p>
+<ul>
+<li>
+<a href="./whoweare.html">Who We Are</a>
+</li>
+<li>
+<a href="./heritage.html">Heritage</a>
+</li>
+<li>
+<a href="http://www.apache.org">Apache Home</a>
+</li>
+<li>
+<a href="./resources.html">Resources</a>
+</li>
+<li>
+<a href="./contact.html">Contact</a>
+</li>
+<li>
+<a href="./legal.html">Legal</a>
+</li>
+</ul>
+</td>
+<!--RIGHT SIDE MAIN BODY-->
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Apache Tomcat 6.x vulnerabilities">
+<strong>Apache Tomcat 6.x vulnerabilities</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 6.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Fixed in Apache Tomcat 6.?.?">
+<strong>Fixed in Apache Tomcat 6.?.?</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+</td>
+</tr>
+<!--FOOTER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<!--PAGE FOOTER-->
+<tr>
+<td colspan="2">
+<div align="center">
+<font color="#525D76" size="-1">
+<em>
+ Copyright © 1999-2006, The Apache Software Foundation
+ </em>
+</font>
+</div>
+</td>
+</tr>
+</table>
+</body>
+</html>
Propchange: tomcat/site/trunk/docs/security-6.html
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/docs/security-impact.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-impact.html?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/docs/security-impact.html (added)
+++ tomcat/site/trunk/docs/security-impact.html Fri Feb 16 18:53:55 2007
@@ -0,0 +1,341 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<title>Apache Tomcat - Apache Tomcat -- Security Impact Levels</title>
+<meta name="author" value="Apache Tomcat Project"/>
+<meta name="email" value=""/>
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
+</head>
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
+<!--PAGE HEADER-->
+<tr>
+<td>
+<!--PROJECT LOGO-->
+<a href="http://tomcat.apache.org/">
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
+</a>
+</td>
+<td>
+<font face="arial,helvetica,sanserif">
+<h1>Apache Tomcat</h1>
+</font>
+</td>
+<td>
+<!--APACHE LOGO-->
+<a href="http://www.apache.org/">
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
+</a>
+</td>
+</tr>
+</table>
+<div class="searchbox">
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
+</form>
+</div>
+<table border="0" width="100%" cellspacing="4">
+<!--HEADER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<tr>
+<!--LEFT SIDE NAVIGATION-->
+<td width="20%" valign="top" nowrap="true">
+<p>
+<strong>Apache Tomcat</strong>
+</p>
+<ul>
+<li>
+<a href="./index.html">Home</a>
+</li>
+</ul>
+<p>
+<strong>Download</strong>
+</p>
+<ul>
+<li>
+<a href="./whichversion.html">Which version?</a>
+</li>
+<li>
+<a href="./download-55.cgi">Tomcat 5.x</a>
+</li>
+<li>
+<a href="./download-41.cgi">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./download-33.cgi">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./download-connectors.cgi">Tomcat Connectors</a>
+</li>
+<li>
+<a href="http://archive.apache.org/dist/tomcat">Archives</a>
+</li>
+</ul>
+<p>
+<strong>Documentation</strong>
+</p>
+<ul>
+<li>
+<a href="./tomcat-5.5-doc/index.html">Tomcat 5.5</a>
+</li>
+<li>
+<a href="./tomcat-5.0-doc/index.html">Tomcat 5.0</a>
+</li>
+<li>
+<a href="./tomcat-4.1-doc/index.html">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./tomcat-3.3-doc/index.html">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./connectors-doc">Tomcat Connectors</a>
+</li>
+</ul>
+<p>
+<strong>Problems?</strong>
+</p>
+<ul>
+<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
+<a href="./findhelp.html">Find help</a>
+</li>
+<li>
+<a href="./faq/">FAQ</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+<li>
+<a href="./bugreport.html">Bug Database</a>
+</li>
+<li>
+<a href="./irc.html">IRC</a>
+</li>
+</ul>
+<p>
+<strong>Get Involved</strong>
+</p>
+<ul>
+<li>
+<a href="./getinvolved.html">Overview</a>
+</li>
+<li>
+<a href="./svn.html">SVN Repositories</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+</ul>
+<p>
+<strong>Misc</strong>
+</p>
+<ul>
+<li>
+<a href="./whoweare.html">Who We Are</a>
+</li>
+<li>
+<a href="./heritage.html">Heritage</a>
+</li>
+<li>
+<a href="http://www.apache.org">Apache Home</a>
+</li>
+<li>
+<a href="./resources.html">Resources</a>
+</li>
+<li>
+<a href="./contact.html">Contact</a>
+</li>
+<li>
+<a href="./legal.html">Legal</a>
+</li>
+</ul>
+</td>
+<!--RIGHT SIDE MAIN BODY-->
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Summary of security impact levels for Apache Tomcat">
+<strong>Summary of security impact levels for Apache Tomcat</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>The Apache Tomcat Security Team rates the impact of each security flaw
+ that affects Tomcat. We've chosen a rating scale quite similar to those
+ used by other major vendors in order to be consistent. Basically the goal
+ of the rating system is to answer the question "How worried should I be
+ about this vulnerability?".</p>
+
+ <p>Note that the rating chosen for each flaw is the worst possible case
+ across all architectures. To determine the exact impact of a particular
+ vulnerability on your own systems you will still need to read the security
+ advisories to find out more about the flaw.</p>
+
+ <p>We use the following descriptions to decide on the impact rating to give
+ each vulnerability:</p>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Critical">
+<strong>Critical</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>A vulnerability rated with a Critical impact is one which could
+ potentially be exploited by a remote attacker to get Tomcat to execute
+ arbitrary code (either as the user the server is running as, or root).
+ These are the sorts of vulnerabilities that could be exploited
+ automatically by worms.</p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Important">
+<strong>Important</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>A vulnerability rated as Important impact is one which could result in
+ the compromise of data or availability of the server. For Tomcat this
+ includes issues that allow an easy remote denial of service (something
+ that is out of proportion to the attack or with a lasting consequence),
+ access to arbitrary files outside of the context root, or access to files
+ that should be otherwise prevented by limits or authentication.</p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Moderate">
+<strong>Moderate</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>A vulnerability is likely to be rated as Moderate if there is significant
+ mitigation to make the issue less of an impact. This might be because the
+ flaw does not affect likely configurations, or it is a configuration that
+ isn't widely used, or where a remote user must be authenticated in order
+ to exploit the issue. Flaws that allow Tomcat to serve directory listings
+ instead of index files and cross-site scripting issues are included here.
+ </p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Low">
+<strong>Low</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>All other security flaws are classed as a Low impact. This rating is used
+ for issues that are believed to be extremely hard to exploit, or where an
+ exploit gives minimal consequences.</p>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+</td>
+</tr>
+<!--FOOTER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<!--PAGE FOOTER-->
+<tr>
+<td colspan="2">
+<div align="center">
+<font color="#525D76" size="-1">
+<em>
+ Copyright © 1999-2006, The Apache Software Foundation
+ </em>
+</font>
+</div>
+</td>
+</tr>
+</table>
+</body>
+</html>
Propchange: tomcat/site/trunk/docs/security-impact.html
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/docs/security.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security.html?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/docs/security.html (added)
+++ tomcat/site/trunk/docs/security.html Fri Feb 16 18:53:55 2007
@@ -0,0 +1,286 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<title>Apache Tomcat - Apache Tomcat -- Reporting Security Problems</title>
+<meta name="author" value="Apache Tomcat Project"/>
+<meta name="email" value=""/>
+<link type="text/css" href="stylesheets/tomcat.css" rel="stylesheet"/>
+</head>
+<body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76">
+<table border="0" width="100%" cellspacing="0">
+<!--PAGE HEADER-->
+<tr>
+<td>
+<!--PROJECT LOGO-->
+<a href="http://tomcat.apache.org/">
+<img src="./images/tomcat.gif" align="left" alt="Tomcat Logo" border="0"/>
+</a>
+</td>
+<td>
+<font face="arial,helvetica,sanserif">
+<h1>Apache Tomcat</h1>
+</font>
+</td>
+<td>
+<!--APACHE LOGO-->
+<a href="http://www.apache.org/">
+<img src="http://www.apache.org/images/asf-logo.gif" align="right" alt="Apache Logo" border="0"/>
+</a>
+</td>
+</tr>
+</table>
+<div class="searchbox">
+<form action="http://www.google.com/search" method="get">
+<input value="tomcat.apache.org" name="sitesearch" type="hidden"/>
+<input value="Search the Site" size="25" name="q" id="query" type="text"/>
+<input name="Search" value="Search Site" type="submit"/>
+</form>
+</div>
+<table border="0" width="100%" cellspacing="4">
+<!--HEADER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<tr>
+<!--LEFT SIDE NAVIGATION-->
+<td width="20%" valign="top" nowrap="true">
+<p>
+<strong>Apache Tomcat</strong>
+</p>
+<ul>
+<li>
+<a href="./index.html">Home</a>
+</li>
+</ul>
+<p>
+<strong>Download</strong>
+</p>
+<ul>
+<li>
+<a href="./whichversion.html">Which version?</a>
+</li>
+<li>
+<a href="./download-60.cgi">Tomcat 6.x</a>
+</li>
+<li>
+<a href="./download-55.cgi">Tomcat 5.x</a>
+</li>
+<li>
+<a href="./download-41.cgi">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./download-33.cgi">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./download-connectors.cgi">Tomcat Connectors</a>
+</li>
+<li>
+<a href="http://archive.apache.org/dist/tomcat">Archives</a>
+</li>
+</ul>
+<p>
+<strong>Documentation</strong>
+</p>
+<ul>
+<li>
+<a href="./tomcat-6.0-doc/index.html">Tomcat 6.0</a>
+</li>
+<li>
+<a href="./tomcat-5.5-doc/index.html">Tomcat 5.5</a>
+</li>
+<li>
+<a href="./tomcat-5.0-doc/index.html">Tomcat 5.0</a>
+</li>
+<li>
+<a href="./tomcat-4.1-doc/index.html">Tomcat 4.1</a>
+</li>
+<li>
+<a href="./tomcat-3.3-doc/index.html">Tomcat 3.3</a>
+</li>
+<li>
+<a href="./connectors-doc">Tomcat Connectors</a>
+</li>
+</ul>
+<p>
+<strong>Problems?</strong>
+</p>
+<ul>
+<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
+<a href="./findhelp.html">Find help</a>
+</li>
+<li>
+<a href="./faq/">FAQ</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+<li>
+<a href="./bugreport.html">Bug Database</a>
+</li>
+<li>
+<a href="./irc.html">IRC</a>
+</li>
+</ul>
+<p>
+<strong>Get Involved</strong>
+</p>
+<ul>
+<li>
+<a href="./getinvolved.html">Overview</a>
+</li>
+<li>
+<a href="./svn.html">SVN Repositories</a>
+</li>
+<li>
+<a href="./lists.html">Mailing Lists</a>
+</li>
+</ul>
+<p>
+<strong>Misc</strong>
+</p>
+<ul>
+<li>
+<a href="./whoweare.html">Who We Are</a>
+</li>
+<li>
+<a href="./heritage.html">Heritage</a>
+</li>
+<li>
+<a href="http://www.apache.org">Apache Home</a>
+</li>
+<li>
+<a href="./resources.html">Resources</a>
+</li>
+<li>
+<a href="./contact.html">Contact</a>
+</li>
+<li>
+<a href="./legal.html">Legal</a>
+</li>
+</ul>
+</td>
+<!--RIGHT SIDE MAIN BODY-->
+<td width="80%" valign="top" align="left">
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Security Updates">
+<strong>Security Updates</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>These pages are a work in progress. Additional information will be added
+ as it is identified.</p>
+ <p>Lists of security problems fixed in released versions of Apache Tomcat
+ are available:</p>
+ <ul>
+ <li>
+<a href="security-6.html">Apache Tomcat 6.x Security Vulnerabilitites
+ </a>
+</li>
+ <li>
+<a href="security-5.html">Apache Tomcat 5.x Security Vulnerabilitites
+ </a>
+</li>
+ <li>
+<a href="security-4.html">Apache Tomcat 4.x Security Vulnerabilitites
+ </a>
+</li>
+ <li>
+<a href="security-3.html">Apache Tomcat 3.x Security Vulnerabilitites
+ </a>
+</li>
+ </ul>
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+<table border="0" cellspacing="0" cellpadding="2" width="100%">
+<tr>
+<td bgcolor="#525D76">
+<font color="#ffffff" face="arial,helvetica,sanserif">
+<a name="Reporting New Security Problems with Apache Tomcat">
+<strong>Reporting New Security Problems with Apache Tomcat</strong>
+</a>
+</font>
+</td>
+</tr>
+<tr>
+<td>
+<p>
+<blockquote>
+ <p>The Apache Software Foundation takes a very active stance in eliminating
+ security problems and denial of service attacks against Apache Tomcat.
+ </p>
+ <p>We strongly encourage folks to report such problems to our private
+ security mailing list first, before disclosing them in a public forum.</p>
+
+ <p>
+<strong>We cannot accept regular bug reports or other queries at this
+ address, we ask that you use our <a href="bugreport.html">bug reporting
+ page</a> for those. All mail sent to this address that does not relate to
+ security problems in the Apache Tomcat source code will be ignored.
+ </strong>
+</p>
+ <p>The mailing address is: <a href="mailto:security@tomcat.apache.org">
+ security@tomcat.apache.org</a>
+</p>
+
+ <p>Note that all networked servers are subject to denial of service attacks,
+ and we cannot promise magic workarounds to generic problems (such as a
+ client streaming lots of data to your server, or re-requesting the same
+ URL repeatedly). In general our philosophy is to avoid any attacks which
+ can cause the server to consume resources in a non-linear relationship to
+ the size of inputs.</p>
+
+ </blockquote>
+</p>
+</td>
+</tr>
+<tr>
+<td>
+<br/>
+</td>
+</tr>
+</table>
+</td>
+</tr>
+<!--FOOTER SEPARATOR-->
+<tr>
+<td colspan="2">
+<hr noshade="" size="1"/>
+</td>
+</tr>
+<!--PAGE FOOTER-->
+<tr>
+<td colspan="2">
+<div align="center">
+<font color="#525D76" size="-1">
+<em>
+ Copyright © 1999-2006, The Apache Software Foundation
+ </em>
+</font>
+</div>
+</td>
+</tr>
+</table>
+</body>
+</html>
Propchange: tomcat/site/trunk/docs/security.html
------------------------------------------------------------------------------
svn:eol-style = native
Modified: tomcat/site/trunk/docs/svn.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/svn.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/svn.html (original)
+++ tomcat/site/trunk/docs/svn.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/whichversion.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/whichversion.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/whichversion.html (original)
+++ tomcat/site/trunk/docs/whichversion.html Fri Feb 16 18:53:55 2007
@@ -111,6 +111,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Modified: tomcat/site/trunk/docs/whoweare.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/whoweare.html?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/docs/whoweare.html (original)
+++ tomcat/site/trunk/docs/whoweare.html Fri Feb 16 18:53:55 2007
@@ -107,6 +107,9 @@
</p>
<ul>
<li>
+<a href="./security.html">Security Reports</a>
+</li>
+<li>
<a href="./findhelp.html">Find help</a>
</li>
<li>
Added: tomcat/site/trunk/xdocs/security-3.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-3.xml?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/xdocs/security-3.xml (added)
+++ tomcat/site/trunk/xdocs/security-3.xml Fri Feb 16 18:53:55 2007
@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<document>
+
+ <properties>
+ <author>Apache Tomcat Project</author>
+ <title>Apache Tomcat 3.x vulnerabilities</title>
+ </properties>
+
+<body>
+
+ <section name="Apache Tomcat 3.x vulnerabilities">
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 3.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </section>
+
+ <section name="Fixed in Apache Tomcat 3.?.?">
+
+ </section>
+</body>
+</document>
+
Propchange: tomcat/site/trunk/xdocs/security-3.xml
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/xdocs/security-4.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-4.xml?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/xdocs/security-4.xml (added)
+++ tomcat/site/trunk/xdocs/security-4.xml Fri Feb 16 18:53:55 2007
@@ -0,0 +1,55 @@
+<?xml version="1.0"?>
+<document>
+
+ <properties>
+ <author>Apache Tomcat Project</author>
+ <title>Apache Tomcat 4.x vulnerabilities</title>
+ </properties>
+
+<body>
+
+ <section name="Apache Tomcat 4.x vulnerabilities">
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 4.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </section>
+
+ <section name="Fixed in Apache Tomcat 4.1.32">
+ <p><strong>low: Directory listing</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3835">
+ CVE-2006-3835</a></p>
+
+ <p>This is expected behaviour when directory listings are enabled. The
+ semicolon (;) is the separator for path parameters so inserting one
+ before a file name changes the request into a request for a directory
+ with a path parameter. If directory listings are enabled, a diretcory
+ listing will be shown. In response to this and other directory listing
+ issues, directory listings were changed to be disabled by default.</p>
+
+ <p>Affects: 4.0.0-4.0.6, 4.1.0-4.1.31</p>
+ </section>
+
+ <section name="Unverified">
+ <p><strong>low: Installation path disclosure</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4703">
+ CVE-2005-4703</a></p>
+ <p>This issue only affects Windows operating systems. It can not be
+ reproduced on Windows XP Home with JDKs 1.3.1, 1.4.2, 1.5.0 or 1.6.0.
+ Further investigation is required to determine the Windows operating
+ system and JDK combinations that do exhibit this issue.</p>
+
+ <p>Affects: 4.0.3?</p>
+ </section>
+</body>
+</document>
+
Propchange: tomcat/site/trunk/xdocs/security-4.xml
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/xdocs/security-5.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-5.xml?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/xdocs/security-5.xml (added)
+++ tomcat/site/trunk/xdocs/security-5.xml Fri Feb 16 18:53:55 2007
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<document>
+
+ <properties>
+ <author>Apache Tomcat Project</author>
+ <title>Apache Tomcat 5.x vulnerabilities</title>
+ </properties>
+
+<body>
+
+ <section name="Apache Tomcat 5.x vulnerabilities">
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 5.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </section>
+
+ <section name="Fixed in Apache Tomcat 5.5.13, 5.0.HEAD">
+ <p><strong>low: Directory listing</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3835">
+ CVE-2006-3835</a></p>
+
+ <p>This is expected behaviour when directory listings are enabled. The
+ semicolon (;) is the separator for path parameters so inserting one
+ before a file name changes the request into a request for a directory
+ with a path parameter. If directory listings are enabled, a diretcory
+ listing will be shown. In response to this and other directory listing
+ issues, directory listings were changed to be disabled by default.</p>
+
+ <p>Affects: 5.0.0-5.5.30, 5.5.0-5.5.12</p>
+ </section>
+</body>
+</document>
+
Propchange: tomcat/site/trunk/xdocs/security-5.xml
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/xdocs/security-6.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-6.xml?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/xdocs/security-6.xml (added)
+++ tomcat/site/trunk/xdocs/security-6.xml Fri Feb 16 18:53:55 2007
@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<document>
+
+ <properties>
+ <author>Apache Tomcat Project</author>
+ <title>Apache Tomcat 6.x vulnerabilities</title>
+ </properties>
+
+<body>
+
+ <section name="Apache Tomcat 6.x vulnerabilities">
+ <p>This page lists all security vulnerabilities fixed in released versions
+ of Apache Tomcat 6.x. Each vulnerability is given a
+ <a href="security-impact.html">security impact rating</a> by the Apache
+ Tomcat security team - please note that this rating may vary from
+ platform to platform. We also list the versions of Apache Tomcat the flaw
+ is known to affect, and where a flaw has not been verified list the
+ version with a question mark.</p>
+
+ <p>This page has been created from a review of the Apache Tomcat archives
+ and the CVE list. Please send comments or corrections for these
+ vulnerabilities to the <a href="mailto:security@tomcat.apache.org">Tomcat
+ Security Team</a>.</p>
+
+ </section>
+
+ <section name="Fixed in Apache Tomcat 6.?.?">
+
+ </section>
+</body>
+</document>
+
Propchange: tomcat/site/trunk/xdocs/security-6.xml
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/xdocs/security-impact.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-impact.xml?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/xdocs/security-impact.xml (added)
+++ tomcat/site/trunk/xdocs/security-impact.xml Fri Feb 16 18:53:55 2007
@@ -0,0 +1,62 @@
+<?xml version="1.0"?>
+<document>
+
+ <properties>
+ <author>Apache Tomcat Project</author>
+ <title>Apache Tomcat -- Security Impact Levels</title>
+ </properties>
+
+<body>
+ <section name="Summary of security impact levels for Apache Tomcat">
+ <p>The Apache Tomcat Security Team rates the impact of each security flaw
+ that affects Tomcat. We've chosen a rating scale quite similar to those
+ used by other major vendors in order to be consistent. Basically the goal
+ of the rating system is to answer the question "How worried should I be
+ about this vulnerability?".</p>
+
+ <p>Note that the rating chosen for each flaw is the worst possible case
+ across all architectures. To determine the exact impact of a particular
+ vulnerability on your own systems you will still need to read the security
+ advisories to find out more about the flaw.</p>
+
+ <p>We use the following descriptions to decide on the impact rating to give
+ each vulnerability:</p>
+
+ </section>
+
+ <section name="Critical">
+ <p>A vulnerability rated with a Critical impact is one which could
+ potentially be exploited by a remote attacker to get Tomcat to execute
+ arbitrary code (either as the user the server is running as, or root).
+ These are the sorts of vulnerabilities that could be exploited
+ automatically by worms.</p>
+ </section>
+
+ <section name="Important">
+ <p>A vulnerability rated as Important impact is one which could result in
+ the compromise of data or availability of the server. For Tomcat this
+ includes issues that allow an easy remote denial of service (something
+ that is out of proportion to the attack or with a lasting consequence),
+ access to arbitrary files outside of the context root, or access to files
+ that should be otherwise prevented by limits or authentication.</p>
+ </section>
+
+ <section name="Moderate">
+ <p>A vulnerability is likely to be rated as Moderate if there is significant
+ mitigation to make the issue less of an impact. This might be because the
+ flaw does not affect likely configurations, or it is a configuration that
+ isn't widely used, or where a remote user must be authenticated in order
+ to exploit the issue. Flaws that allow Tomcat to serve directory listings
+ instead of index files and cross-site scripting issues are included here.
+ </p>
+ </section>
+
+ <section name="Low">
+ <p>All other security flaws are classed as a Low impact. This rating is used
+ for issues that are believed to be extremely hard to exploit, or where an
+ exploit gives minimal consequences.</p>
+ </section>
+
+</body>
+</document>
+
Propchange: tomcat/site/trunk/xdocs/security-impact.xml
------------------------------------------------------------------------------
svn:eol-style = native
Added: tomcat/site/trunk/xdocs/security.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security.xml?view=auto&rev=508702
==============================================================================
--- tomcat/site/trunk/xdocs/security.xml (added)
+++ tomcat/site/trunk/xdocs/security.xml Fri Feb 16 18:53:55 2007
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<document>
+
+ <properties>
+ <author>Apache Tomcat Project</author>
+ <title>Apache Tomcat -- Reporting Security Problems</title>
+ </properties>
+
+<body>
+ <section name="Security Updates">
+ <p>These pages are a work in progress. Additional information will be added
+ as it is identified.</p>
+ <p>Lists of security problems fixed in released versions of Apache Tomcat
+ are available:</p>
+ <ul>
+ <li><a href="security-6.html">Apache Tomcat 6.x Security Vulnerabilitites
+ </a></li>
+ <li><a href="security-5.html">Apache Tomcat 5.x Security Vulnerabilitites
+ </a></li>
+ <li><a href="security-4.html">Apache Tomcat 4.x Security Vulnerabilitites
+ </a></li>
+ <li><a href="security-3.html">Apache Tomcat 3.x Security Vulnerabilitites
+ </a></li>
+ </ul>
+ </section>
+
+ <section name="Reporting New Security Problems with Apache Tomcat">
+ <p>The Apache Software Foundation takes a very active stance in eliminating
+ security problems and denial of service attacks against Apache Tomcat.
+ </p>
+ <p>We strongly encourage folks to report such problems to our private
+ security mailing list first, before disclosing them in a public forum.</p>
+
+ <p><strong>We cannot accept regular bug reports or other queries at this
+ address, we ask that you use our <a href="bugreport.html">bug reporting
+ page</a> for those. All mail sent to this address that does not relate to
+ security problems in the Apache Tomcat source code will be ignored.
+ </strong></p>
+ <p>The mailing address is: <a href="mailto:security@tomcat.apache.org">
+ security@tomcat.apache.org</a></p>
+
+ <p>Note that all networked servers are subject to denial of service attacks,
+ and we cannot promise magic workarounds to generic problems (such as a
+ client streaming lots of data to your server, or re-requesting the same
+ URL repeatedly). In general our philosophy is to avoid any attacks which
+ can cause the server to consume resources in a non-linear relationship to
+ the size of inputs.</p>
+
+ </section>
+</body>
+</document>
+
Propchange: tomcat/site/trunk/xdocs/security.xml
------------------------------------------------------------------------------
svn:eol-style = native
Modified: tomcat/site/trunk/xdocs/stylesheets/project.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/stylesheets/project.xml?view=diff&rev=508702&r1=508701&r2=508702
==============================================================================
--- tomcat/site/trunk/xdocs/stylesheets/project.xml (original)
+++ tomcat/site/trunk/xdocs/stylesheets/project.xml Fri Feb 16 18:53:55 2007
@@ -30,6 +30,7 @@
</menu>
<menu name="Problems?">
+ <item name="Security Reports" href="/security.html"/>
<item name="Find help" href="/findhelp.html"/>
<item name="FAQ" href="/faq/"/>
<item name="Mailing Lists" href="/lists.html"/>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org