You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mark Thomas <ma...@apache.org> on 2008/08/01 16:06:33 UTC
[CVE-2008-2370] Apache Tomcat information disclosure vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2008-2370: Apache Tomcat information disclosure vulnerability
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 4.1.0 to 4.1.37
Tomcat 5.5.0 to 5.5.26
Tomcat 6.0.0 to 6.0.16
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected
Description:
When using a RequestDispatcher the target path was normalised before the
query string was removed. A request that included a specially crafted
request parameter could be used to access content that would otherwise be
protected by a security constraint or by locating it in under the WEB-INF
directory.
Mitigation:
6.0.x users should upgrade to 6.0.18
5.5.x users should obtain the latest source from svn or apply this patch
which will be included from 5.5.27
http://svn.apache.org/viewvc?rev=680949&view=rev
4.1.x users should obtain the latest source from svn or apply this patch
which will be included from 4.1.38
http://svn.apache.org/viewvc?rev=680950&view=rev
Example:
For a page that contains:
<%
pageContext.forward("/page2.jsp?somepar=someval&par="+request.getParameter("blah"));
%>
an attacker can use:
http://host/page.jsp?blah=/../WEB-INF/web.xml
Credit:
This issue was discovered by Stefano Di Paola of Minded Security Research
Labs.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkiTGGkACgkQb7IeiTPGAkNeQACdHk1KQ98Dx45Sc+Hslw/YIBH7
8b4An1WZ30LS34Pxx4Rc+VzqhswLLbZd
=Zbvc
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [CVE-2008-2370] Apache Tomcat information disclosure vulnerability
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Mark Thomas wrote:
>
> What mitigations are you thinking of?
>
> The description is intended to be sufficient for a user to determine if
> they match the vulnerability conditions. And this for this notice I
> believe it meets this criteria.
>
> In this case there is no way of configuring yourself away from the
> vulnerability. If you use a RequestDispatcher, you are vulnerable.
My mistake, I understood that if the user was strictly using ISO-8859-1
encoding they were not vulnerable. But I might have missed a few posts
in the backchannel, as I was away teaching all week.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [CVE-2008-2370] Apache Tomcat information disclosure vulnerability
Posted by Mark Thomas <ma...@apache.org>.
William A. Rowe, Jr. wrote:
> Mark Thomas wrote:
>>
>> Description:
>> When using a RequestDispatcher the target path was normalised before the
>> query string was removed. A request that included a specially crafted
>> request parameter could be used to access content that would otherwise be
>> protected by a security constraint or by locating it in under the WEB-INF
>> directory.
>>
>> Mitigation:
>> 6.0.x users should upgrade to 6.0.18
>
> Stupid question, perhaps, but why weren't mitigations published with this
> advisory? In general we want people to simply adopt the current version,
> but if they don't match the vulnerability conditions (or are willing to
> configure themselves away from them), this should not disrupt the active
> installations.
What mitigations are you thinking of?
The description is intended to be sufficient for a user to determine if
they match the vulnerability conditions. And this for this notice I believe
it meets this criteria.
In this case there is no way of configuring yourself away from the
vulnerability. If you use a RequestDispatcher, you are vulnerable.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [CVE-2008-2370] Apache Tomcat information disclosure vulnerability
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Mark Thomas wrote:
>
> Description:
> When using a RequestDispatcher the target path was normalised before the
> query string was removed. A request that included a specially crafted
> request parameter could be used to access content that would otherwise be
> protected by a security constraint or by locating it in under the WEB-INF
> directory.
>
> Mitigation:
> 6.0.x users should upgrade to 6.0.18
Stupid question, perhaps, but why weren't mitigations published with this
advisory? In general we want people to simply adopt the current version,
but if they don't match the vulnerability conditions (or are willing to
configure themselves away from them), this should not disrupt the active
installations.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org