You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Geet Chandra <ge...@gmail.com> on 2012/03/27 15:18:37 UTC
Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Hi All,
Is there any solution or workaround for protection against this security
vulnerability.
-Geet
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Pid <pi...@pidster.com>.
On 27/03/2012 15:28, Geet Chandra wrote:
> This is what I read, now in the solution tab, it says to remove the
> examples folder,but we are shipping the tomcat with our product, can we
> remove the example folder and ship with our product.If not, any other
> workaround/solution.Stoplisted Vulnerabilities for this Host: 2
> Vulnerability12085Apache Tomcat Servlet / JSP Container Default FilesLow
> Risk
> DescriptionThis system is running an Apache Tomcat servlet/JSP container
> with default files (such as documentation, default Servlets and JSPs)
> installed. These files may help an attacker to guess the exact version of
> the Apache Tomcat which is running on this host and may provide other
> useful information. SolutionRemove default files, example JSPs and Servlets
> from the Tomcat Servlet/JSP container. CategoryHosting or infrastructure
> flaw.CVE ReferenceCVE-MAP-NOMATCHCVSS2 .0 (Low)
> (AV:N/AC:L/Au:N/C:N/I:N/A:N)First
> Found13 March 2011Port443/tcpLast 6 Months Stopped*By:*
> joe.bloggs@technicians.com *From:* 12 March 2003 *To:* 12 March 2014
> ReasonYour Company accepts the risk that this vulnerability poses.
So, rather than re-reading what appears to be the untrustworthy output
of a non-human automated scanning tool, (whom you may not engage in
conversation), why not re-read the thread you started and review the
facts given to you by humans* who did engage you in conversation?
Alternatively, consider the following: if a version of Tomcat set off at
1pm and was travelling at 82mph, and another version of Tomcat set off
from a station 417 miles away at 9am and was travelling towards the
first at 63mph, which version is vulnerable to a bug reported in 2002?
p
* well, mostly
--
[key:62590808]
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Geet Chandra <ge...@gmail.com>.
This is what I read, now in the solution tab, it says to remove the
examples folder,but we are shipping the tomcat with our product, can we
remove the example folder and ship with our product.If not, any other
workaround/solution.Stoplisted Vulnerabilities for this Host: 2
Vulnerability12085Apache Tomcat Servlet / JSP Container Default FilesLow
Risk
DescriptionThis system is running an Apache Tomcat servlet/JSP container
with default files (such as documentation, default Servlets and JSPs)
installed. These files may help an attacker to guess the exact version of
the Apache Tomcat which is running on this host and may provide other
useful information. SolutionRemove default files, example JSPs and Servlets
from the Tomcat Servlet/JSP container. CategoryHosting or infrastructure
flaw.CVE ReferenceCVE-MAP-NOMATCHCVSS2 .0 (Low)
(AV:N/AC:L/Au:N/C:N/I:N/A:N)First
Found13 March 2011Port443/tcpLast 6 Months Stopped*By:*
joe.bloggs@technicians.com *From:* 12 March 2003 *To:* 12 March 2014
ReasonYour Company accepts the risk that this vulnerability poses.
On Tue, Mar 27, 2012 at 7:50 PM, Mark Thomas <ma...@apache.org> wrote:
>
>
> Geet Chandra <ge...@gmail.com> wrote:
>
> >I found this information here
> >
> http://www.westpoint.ltd.uk/example-reports/samplereport_westpoint/files/detail_493213.htm
> >
> >
> >I don't see anything about affected versions.
>
> Then try reading a proper vulnerability report rather than the output of a
> vulnerability scanner. Or, as I said before, look at the Tomcat security
> pages.
>
> You have been given all the information you need (and more) to answer this
> question.
>
> Mark
>
>
> >
> >-Geet
> >
> >On Tue, Mar 27, 2012 at 7:20 PM, Mark Thomas <ma...@apache.org> wrote:
> >
> >> On 27/03/2012 14:38, Geet Chandra wrote:
> >> > Using Tomcat version 6.0.35
> >>
> >> In which case go back and read the vulnerability information again
> >and
> >> pay more attention to the part about affected versions.
> >>
> >> You should also read the Tomcat security pages.
> >>
> >> Mark
> >>
> >>
> >> >
> >> > -Geet
> >> >
> >> > On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas <ma...@apache.org>
> >wrote:
> >> >
> >> >> On 27/03/2012 14:29, Geet Chandra wrote:
> >> >>> Here is the CVE Reference:CVE-2002-2006
> >> >>
> >> >> And the Tomcat version you are using?
> >> >>
> >> >> Mark
> >> >>
> >> >>>
> >> >>> On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org>
> >wrote:
> >> >>>
> >> >>>> On 27/03/2012 14:18, Geet Chandra wrote:
> >> >>>>> Hi All,
> >> >>>>>
> >> >>>>> Is there any solution or workaround for protection against this
> >> >> security
> >> >>>>> vulnerability.
> >> >>>>
> >> >>>> What security vulnerability is this? Every published Tomcat
> >security
> >> >>>> vulnerability has a CVE reference to uniquely identify it. What
> >is the
> >> >>>> CVE reference for this issue?
> >> >>>>
> >> >>>> Mark
> >> >>>>
> >> >>>>
> >---------------------------------------------------------------------
> >> >>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> >>>> For additional commands, e-mail: users-help@tomcat.apache.org
> >> >>>>
> >> >>>>
> >> >>>
> >> >>>
> >> >>
> >> >>
> >> >>
> >---------------------------------------------------------------------
> >> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >> >>
> >> >>
> >> >
> >> >
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
> >
> >
> >--
> >Thanks & Regards
> >Geet
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Thanks & Regards
Geet
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files
Posted by Mark Thomas <ma...@apache.org>.
Geet Chandra <ge...@gmail.com> wrote:
>I found this information here
>http://www.westpoint.ltd.uk/example-reports/samplereport_westpoint/files/detail_493213.htm
>
>
>I don't see anything about affected versions.
Then try reading a proper vulnerability report rather than the output of a vulnerability scanner. Or, as I said before, look at the Tomcat security pages.
You have been given all the information you need (and more) to answer this question.
Mark
>
>-Geet
>
>On Tue, Mar 27, 2012 at 7:20 PM, Mark Thomas <ma...@apache.org> wrote:
>
>> On 27/03/2012 14:38, Geet Chandra wrote:
>> > Using Tomcat version 6.0.35
>>
>> In which case go back and read the vulnerability information again
>and
>> pay more attention to the part about affected versions.
>>
>> You should also read the Tomcat security pages.
>>
>> Mark
>>
>>
>> >
>> > -Geet
>> >
>> > On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas <ma...@apache.org>
>wrote:
>> >
>> >> On 27/03/2012 14:29, Geet Chandra wrote:
>> >>> Here is the CVE Reference:CVE-2002-2006
>> >>
>> >> And the Tomcat version you are using?
>> >>
>> >> Mark
>> >>
>> >>>
>> >>> On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org>
>wrote:
>> >>>
>> >>>> On 27/03/2012 14:18, Geet Chandra wrote:
>> >>>>> Hi All,
>> >>>>>
>> >>>>> Is there any solution or workaround for protection against this
>> >> security
>> >>>>> vulnerability.
>> >>>>
>> >>>> What security vulnerability is this? Every published Tomcat
>security
>> >>>> vulnerability has a CVE reference to uniquely identify it. What
>is the
>> >>>> CVE reference for this issue?
>> >>>>
>> >>>> Mark
>> >>>>
>> >>>>
>---------------------------------------------------------------------
>> >>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> >>>> For additional commands, e-mail: users-help@tomcat.apache.org
>> >>>>
>> >>>>
>> >>>
>> >>>
>> >>
>> >>
>> >>
>---------------------------------------------------------------------
>> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> >> For additional commands, e-mail: users-help@tomcat.apache.org
>> >>
>> >>
>> >
>> >
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
>
>--
>Thanks & Regards
>Geet
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Information regarding 12085 - Apache Tomcat servlet/JSP
container default files
Posted by Daniel Mikusa <dm...@vmware.com>.
https://tomcat.apache.org/security-4.html#Fixed_in_Apache_Tomcat_4.1.0
or
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2006
"The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets. "
Dan
----- Original Message -----
> I found this information here
> http://www.westpoint.ltd.uk/example-reports/samplereport_westpoint/files/detail_493213.htm
>
>
> I don't see anything about affected versions.
>
> -Geet
>
> On Tue, Mar 27, 2012 at 7:20 PM, Mark Thomas <ma...@apache.org>
> wrote:
>
> > On 27/03/2012 14:38, Geet Chandra wrote:
> > > Using Tomcat version 6.0.35
> >
> > In which case go back and read the vulnerability information again
> > and
> > pay more attention to the part about affected versions.
> >
> > You should also read the Tomcat security pages.
> >
> > Mark
> >
> >
> > >
> > > -Geet
> > >
> > > On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas <ma...@apache.org>
> > > wrote:
> > >
> > >> On 27/03/2012 14:29, Geet Chandra wrote:
> > >>> Here is the CVE Reference:CVE-2002-2006
> > >>
> > >> And the Tomcat version you are using?
> > >>
> > >> Mark
> > >>
> > >>>
> > >>> On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org>
> > >>> wrote:
> > >>>
> > >>>> On 27/03/2012 14:18, Geet Chandra wrote:
> > >>>>> Hi All,
> > >>>>>
> > >>>>> Is there any solution or workaround for protection against
> > >>>>> this
> > >> security
> > >>>>> vulnerability.
> > >>>>
> > >>>> What security vulnerability is this? Every published Tomcat
> > >>>> security
> > >>>> vulnerability has a CVE reference to uniquely identify it.
> > >>>> What is the
> > >>>> CVE reference for this issue?
> > >>>>
> > >>>> Mark
> > >>>>
> > >>>> ---------------------------------------------------------------------
> > >>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > >>>> For additional commands, e-mail: users-help@tomcat.apache.org
> > >>>>
> > >>>>
> > >>>
> > >>>
> > >>
> > >>
> > >> ---------------------------------------------------------------------
> > >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > >> For additional commands, e-mail: users-help@tomcat.apache.org
> > >>
> > >>
> > >
> > >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
> >
>
>
> --
> Thanks & Regards
> Geet
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Geet Chandra <ge...@gmail.com>.
I found this information here
http://www.westpoint.ltd.uk/example-reports/samplereport_westpoint/files/detail_493213.htm
I don't see anything about affected versions.
-Geet
On Tue, Mar 27, 2012 at 7:20 PM, Mark Thomas <ma...@apache.org> wrote:
> On 27/03/2012 14:38, Geet Chandra wrote:
> > Using Tomcat version 6.0.35
>
> In which case go back and read the vulnerability information again and
> pay more attention to the part about affected versions.
>
> You should also read the Tomcat security pages.
>
> Mark
>
>
> >
> > -Geet
> >
> > On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas <ma...@apache.org> wrote:
> >
> >> On 27/03/2012 14:29, Geet Chandra wrote:
> >>> Here is the CVE Reference:CVE-2002-2006
> >>
> >> And the Tomcat version you are using?
> >>
> >> Mark
> >>
> >>>
> >>> On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org> wrote:
> >>>
> >>>> On 27/03/2012 14:18, Geet Chandra wrote:
> >>>>> Hi All,
> >>>>>
> >>>>> Is there any solution or workaround for protection against this
> >> security
> >>>>> vulnerability.
> >>>>
> >>>> What security vulnerability is this? Every published Tomcat security
> >>>> vulnerability has a CVE reference to uniquely identify it. What is the
> >>>> CVE reference for this issue?
> >>>>
> >>>> Mark
> >>>>
> >>>> ---------------------------------------------------------------------
> >>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >>>> For additional commands, e-mail: users-help@tomcat.apache.org
> >>>>
> >>>>
> >>>
> >>>
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Thanks & Regards
Geet
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Mark Thomas <ma...@apache.org>.
On 27/03/2012 14:38, Geet Chandra wrote:
> Using Tomcat version 6.0.35
In which case go back and read the vulnerability information again and
pay more attention to the part about affected versions.
You should also read the Tomcat security pages.
Mark
>
> -Geet
>
> On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas <ma...@apache.org> wrote:
>
>> On 27/03/2012 14:29, Geet Chandra wrote:
>>> Here is the CVE Reference:CVE-2002-2006
>>
>> And the Tomcat version you are using?
>>
>> Mark
>>
>>>
>>> On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org> wrote:
>>>
>>>> On 27/03/2012 14:18, Geet Chandra wrote:
>>>>> Hi All,
>>>>>
>>>>> Is there any solution or workaround for protection against this
>> security
>>>>> vulnerability.
>>>>
>>>> What security vulnerability is this? Every published Tomcat security
>>>> vulnerability has a CVE reference to uniquely identify it. What is the
>>>> CVE reference for this issue?
>>>>
>>>> Mark
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>>> For additional commands, e-mail: users-help@tomcat.apache.org
>>>>
>>>>
>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Geet Chandra <ge...@gmail.com>.
Using Tomcat version 6.0.35
-Geet
On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas <ma...@apache.org> wrote:
> On 27/03/2012 14:29, Geet Chandra wrote:
> > Here is the CVE Reference:CVE-2002-2006
>
> And the Tomcat version you are using?
>
> Mark
>
> >
> > On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org> wrote:
> >
> >> On 27/03/2012 14:18, Geet Chandra wrote:
> >>> Hi All,
> >>>
> >>> Is there any solution or workaround for protection against this
> security
> >>> vulnerability.
> >>
> >> What security vulnerability is this? Every published Tomcat security
> >> vulnerability has a CVE reference to uniquely identify it. What is the
> >> CVE reference for this issue?
> >>
> >> Mark
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Thanks & Regards
Geet
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Mark Thomas <ma...@apache.org>.
On 27/03/2012 14:29, Geet Chandra wrote:
> Here is the CVE Reference:CVE-2002-2006
And the Tomcat version you are using?
Mark
>
> On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org> wrote:
>
>> On 27/03/2012 14:18, Geet Chandra wrote:
>>> Hi All,
>>>
>>> Is there any solution or workaround for protection against this security
>>> vulnerability.
>>
>> What security vulnerability is this? Every published Tomcat security
>> vulnerability has a CVE reference to uniquely identify it. What is the
>> CVE reference for this issue?
>>
>> Mark
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Geet Chandra <ge...@gmail.com>.
Here is the CVE Reference:CVE-2002-2006
On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas <ma...@apache.org> wrote:
> On 27/03/2012 14:18, Geet Chandra wrote:
> > Hi All,
> >
> > Is there any solution or workaround for protection against this security
> > vulnerability.
>
> What security vulnerability is this? Every published Tomcat security
> vulnerability has a CVE reference to uniquely identify it. What is the
> CVE reference for this issue?
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Thanks & Regards
Geet
Re: Information regarding 12085 - Apache Tomcat servlet/JSP container
default files
Posted by Mark Thomas <ma...@apache.org>.
On 27/03/2012 14:18, Geet Chandra wrote:
> Hi All,
>
> Is there any solution or workaround for protection against this security
> vulnerability.
What security vulnerability is this? Every published Tomcat security
vulnerability has a CVE reference to uniquely identify it. What is the
CVE reference for this issue?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org