[4.0] [Seurity] Security problem when using the SecurityManager with a request dispatcher

[Remy Maucherat <re...@apache.org>]

Hi,

A security problem affecting Tomcat 4.0.2 (and all versions of 4.x) has been
reported, which allows to get a request dispatcher to an URL outside of the
context root.

This is not a security problem when NOT using a security manager, since it
is always possible to use direct filesystem access to achieve the same
result.

However, this vulnerability allows to bypass the security manager
protection, and serve resources located anywhere on the server.

For example, this vulnerability can be reproduced by adding an include
command inside a JSP page, like <jsp:include
page="../../../foo2/jsp/include/bar.txt"/>.

A Tomcat release including the fix will be made available shortly.

Remy


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>