Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.14. It is, therefore, affected by the following vulnerabilities :

  - Cross-site scripting (XSS) vulnerabilities exists due     to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker     can exploit this, by convincing a user to click a specially     crafted URL, to execute arbitrary script code in a user's     browser session. (CVE-2007-2449, CVE-2007-2450,     CVE-2007-3386)

  - Session hijacking vulnerabilities exists in Tomcat due to     incorrect handling of specific special characters in cookie     values. In certain cases an attacker could leverage this     to leak sensitive information, such as the session ID.
    (CVE-2007-3382, CVE-2007-3385)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0871 advisory.

    [5.5.23-0jpp.3.0.2]
     - Patch for CVE-2007-3382 and CVE-2007-3385        Resolves: rhbz#254155

     [5.5.23-0jpp.3.0.1]
     - Patch for CVE-2007-3386        Resolves: rhbz#254155

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance Apache Tomcat running on the remote host is 5.0.x equal to or prior to 5.0.30 or 5.5.x prior to 5.5.25. It is, therefore, affected by multiple vulnerabilities :

  - An error exists in several JSP example files that allows     script injection via URLs using the ';' character.
    (CVE-2007-2449)

  - The Manager and Host Manager applications do not     properly sanitize the 'filename' parameter of the     '/manager/html/upload' script, which can lead to cross-     site scripting attacks. (CVE-2007-2450)

  - An error exists in the handling of cookie values     containing single quotes which Tomcat treats as     delimiters. This can allow disclosure of sensitive     information such as session IDs. (CVE-2007-3382)

  - An error exists in the handling of cookie values     containing backslashes which Tomcat treats as     delimiters. This can allow disclosure of sensitive     information such as session IDs. (CVE-2007-3385)

  - An error exists in the Host Manager application which     allows script injection. (CVE-2007-3386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 4.x listening on the remote host is prior to 4.1.37. It is, therefore, affected by the following vulnerabilities :

  - The remote Apache Tomcat install may be vulnerable to an     information disclosure attack if the deprecated AJP     connector processes a client request having a non-zero     Content-Length and the client disconnects before     sending the request body. (CVE-2005-3164)

  - The remote Apache Tomcat install may be vulnerable to     a cross-site scripting attack if the JSP and Servlet     examples are enabled. Several of these examples do     not properly validate user input.
    (CVE-2007-1355, CVE-2007-2449)

  - The remote Apache Tomcat install may be vulnerable to     a cross-site scripting attack if the Manager web     application is enabled as it fails to escape input     data. (CVE-2007-2450)

  - The remote Apache Tomcat install may be vulnerable to an     information disclosure attack via cookies. Apache Tomcat     treats the single quote character in a cookie as a     delimiter which can lead to information, such as session     ID, to be disclosed. (CVE-2007-3382)

  - The remote Apache Tomcat install may be vulnerable to     a cross-site scripting attack if the SendMailServlet is     enabled. The SendMailServlet is a part of the examples     web application and, when reporting error messages,     fails to escape user provided data. (CVE-2007-3383)

  - The remote Apache Tomcat install may be vulnerable to an     information disclosure attack via cookies. The previous     fix for CVE-2007-3385 was incomplete and did not account     for the use of quotes or '%5C' in cookie values.
    (CVE-2007-3385, CVE-2007-5333)

  - The remote Apache Tomcat install may be vulnerable to an     information disclosure attack via the WebDAV servlet.
    Certain WebDAV requests, containing an entity with a     SYSTEM tag, can result in the disclosure of arbitrary     file contents. (CVE-2007-5461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number..

Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server 4.2. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687, CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

During an internal security review, a cross-site scripting flaw was found that affected the Red Hat Network channel search feature.
(CVE-2007-5961)

This release also corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306)

Multiple flaws were fixed in the IBM Java 1.4.2 Runtime.
(CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789)

Two arbitrary code execution flaws were fixed in the OpenMotif package. (CVE-2005-3964, CVE-2005-0605)

A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898)

Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510)

Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues.

Updated tomcat packages that fix multiple security issues are now available for Red Hat Network Satellite Server.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and JavaServer Pages technologies.

It was reported Tomcat did not properly handle the following character sequence in a cookie: \' (a backslash followed by a double-quote). It was possible remote attackers could use this failure to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3385).

Tomcat was found treating single quote characters -- ' -- as delimiters in cookies. This could allow remote attackers to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3382).

The default Tomcat configuration permitted the use of insecure SSL cipher suites including the anonymous cipher suite. (CVE-2007-1858)

Tomcat permitted various characters as path delimiters. If Tomcat was used behind certain proxies and configured to only proxy some contexts, an attacker could construct an HTTP request to work around the context restriction and potentially access non-proxied content.
(CVE-2007-0450)

Directory listings were enabled by default in Tomcat. Information stored unprotected under the document root was visible to anyone if the administrator did not disable directory listings. (CVE-2006-3835)

It was found that generating listings of large directories was CPU intensive. An attacker could make repeated requests to obtain a directory listing of any large directory, leading to a denial of service. (CVE-2005-3510)

Tomcat was found to accept multiple content-length headers in a request. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks. (CVE-2005-2090)

Users should upgrade to these erratum packages which contain an update to Tomcat that resolves these issues, and add the tyrex and jakarta-commons-pool packages which are required dependencies of the new Tomcat version.

Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and Java Server Pages technologies.

Tomcat was found treating single quote characters -- ' -- as delimiters in cookies. This could allow remote attackers to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3382).

It was reported Tomcat did not properly handle the following character sequence in a cookie: \' (a backslash followed by a double-quote). It was possible remote attackers could use this failure to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3385).

A cross-site scripting (XSS) vulnerability existed in the Host Manager Servlet. This allowed remote attackers to inject arbitrary HTML and web script via crafted requests (CVE-2007-3386).

Users of Tomcat should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

Websphere has been updated to version 2.1.0.1 to fix several security vulnerabilities in the included subprojects, such as Apache Geronimo and Tomcat. (CVE-2007-0184 / CVE-2007-0185 / CVE-2007-2377 / CVE-2007-2449 / CVE-2007-2450 / CVE-2007-3382 / CVE-2007-3385 / CVE-2007-3386 / CVE-2007-5333 / CVE-2007-5342 / CVE-2007-5461 / CVE-2007-5613 / CVE-2007-5615 / CVE-2007-6286 / CVE-2008-0002 / CVE-2008-1232 / CVE-2008-1947 / CVE-2008-2370 / CVE-2008-2938)

Fixed various issues in tomcat :

  - mod_jk directory traversal. (CVE-2007-1860)

  - Handling of cookies containing a ' character.
    (CVE-2007-3382)

  - Handling of a double-quote character in cookies.
    (CVE-2007-3385)

  - tomcat path traversal / information leak.
    (CVE-2007-5641)

  - tomcat HTTP Request Smuggling. (CVE-2005-2090)

  - tomcat https information disclosure. (CVE-2008-0128)

A number of vulnerabilities were found in Tomcat :

A directory traversal vulnerability, when using certain proxy modules, allows a remote attacker to read arbitrary files via a .. (dot dot) sequence with various slash, backslash, or url-encoded backslash characters (CVE-2007-0450; affects Mandriva Linux 2007.1 only).

Multiple cross-site scripting vulnerabilities in certain JSP files allow remote attackers to inject arbitrary web script or HTML (CVE-2007-2449).

Multiple cross-site scripting vulnerabilities in the Manager and Host Manager web applications allow remote authenticated users to inject arbitrary web script or HTML (CVE-2007-2450).

Tomcat treated single quotes as delimiters in cookies, which could cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks (CVE-2007-3382).

Tomcat did not properly handle the ' character sequence in a cookie value, which could cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks (CVE-2007-3385).

A cross-site scripting vulnerability in the Host Manager servlet allowed remote attackers to inject arbitrary HTML and web script via crafted attacks (CVE-2007-3386).

Finally, an absolute path traversal vulnerability, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag (CVE-2007-5461).

The updated packages have been patched to correct these issues.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-004 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.4. 

Mac OS X 10.5.4 contains security fixes for multiple components.

Fixed various issues in tomcat :

  - CVE-2007-3382: Handling of cookies containing a '     character

  - CVE-2007-3385: Handling of \' in cookies

  - CVE-2007-5641: tomcat path traversal / information leak

  - CVE-2007-1860: directory traversal

  - CVE-2007-3386: tomcat XSS 

  - CVE-2007-5342: insufficient access restrictions

Additionally the dbcp namespace in commons-dbcp.jar was fixed.

Fixed various issues in tomcat :

  - CVE-2006-7196: Cross-site scripting (XSS) vulnerability     in example JSP applications

  - CVE-2007-3382: Handling of cookies containing a '     character

  - CVE-2007-3385: Handling of \' in cookies

  - CVE-2007-5641: tomcat path traversal / information leak

  - CVE-2007-1860: directory traversal

  - CVE-2008-0128: tomcat https information disclosure

  - CVE-2005-2090: tomcat HTTP Request Smuggling

- Cross-site scripting (XSS) vulnerability in example JSP     applications. (CVE-2006-7196)

  - Handling of cookies containing a ' character.
    (CVE-2007-3382)

  - Handling of \' in cookies. (CVE-2007-3385)

  - tomcat path traversal / information leak.
    (CVE-2007-5641)

  - directory traversal. (CVE-2007-1860)

  - tomcat https information disclosure. (CVE-2008-0128)

  - tomcat HTTP Request Smuggling. (CVE-2005-2090)

Several remote vulnerabilities have been discovered in the Tomcat servlet and JSP engine. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3382     It was discovered that single quotes (') in cookies were     treated as a delimiter, which could lead to an     information leak.

  - CVE-2007-3385     It was discovered that the character sequence \' in     cookies was handled incorrectly, which could lead to an     information leak.

  - CVE-2007-5461     It was discovered that the WebDAV servlet is vulnerable     to absolute path traversal.

Several remote vulnerabilities have been discovered in the Tomcat servlet and JSP engine. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3382     It was discovered that single quotes (') in cookies were     treated as a delimiter, which could lead to an     information leak.

  - CVE-2007-3385     It was discovered that the character sequence \' in     cookies was handled incorrectly, which could lead to an     information leak.

  - CVE-2007-3386     It was discovered that the host manager servlet     performed insufficient input validation, which could     lead to a cross-site scripting attack.

  - CVE-2007-5342     It was discovered that the JULI logging component did     not restrict its target path, resulting in potential     denial of service through file overwrites.

  - CVE-2007-5461     It was discovered that the WebDAV servlet is vulnerable     to absolute path traversal.

Updated Tomcat5 packages that fix several security bugs are now available for Fedora Core 8.

This update includes fixes to the following :

  - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450

    - CVE-2007-2449

    - CVE-2007-5461

    - CVE-2007-1358

All users of tomcat are advised to update to these packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Tomcat5 packages that fix several security bugs are now available for Fedora Core 7.

This update includes fixes to the following :

  - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450

    - CVE-2007-2449

    - CVE-2007-5461

    - CVE-2007-1358

All users of tomcat are advised to update to these packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running the Apache Tomcat server.  This version of Tomcat is vulnerable to two distinct classes of flaws.  First, the application is vulnerable to a Cross-Site Scripting flaw in the 'aliases' parameter of the '/host-manager/html/add' script.  Second, the application is vulnerable to a number of flaws that would reveal sensitive information.  An attacker exploiting these flaws would be able to either execute code within client browsers or gain information that would be useful for further attacks against Tomcat. 

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.4.  Mac OS X 10.5.4 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
121113	Apache Tomcat < 6.0.14 Multiple Vulnerabilities	Nessus	Web Servers	medium
67564	Oracle Linux 5 : Moderate: / tomcat (ELSA-2007-0871)	Nessus	Oracle Linux Local Security Checks	medium
51059	Apache Tomcat 5.0.x <= 5.0.30 / 5.5.x < 5.5.25 Multiple Vulnerabilities	Nessus	Web Servers	medium
47030	Apache Tomcat 4.x < 4.1.37 Multiple Vulnerabilities	Nessus	Web Servers	medium
43837	RHEL 3 / 4 : Satellite Server (RHSA-2008:0524)	Nessus	Red Hat Local Security Checks	critical
43835	RHEL 4 : Satellite Server (RHSA-2008:0261)	Nessus	Red Hat Local Security Checks	critical
43834	RHEL 3 / 4 : tomcat in Satellite Server (RHSA-2007:1069)	Nessus	Red Hat Local Security Checks	medium
43651	CentOS 5 : tomcat (CESA-2007:0871)	Nessus	CentOS Local Security Checks	medium
41596	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 5850)	Nessus	SuSE Local Security Checks	high
41198	SuSE9 Security Update : Tomcat (YOU Patch Number 12078)	Nessus	SuSE Local Security Checks	medium
38147	Mandrake Linux Security Advisory : tomcat5 (MDKSA-2007:241)	Nessus	Mandriva Local Security Checks	medium
33282	Mac OS X Multiple Vulnerabilities (Security Update 2008-004)	Nessus	MacOS X Local Security Checks	critical
33281	Mac OS X 10.5.x < 10.5.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
31338	openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-4997)	Nessus	SuSE Local Security Checks	medium
31319	openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-4992)	Nessus	SuSE Local Security Checks	medium
31298	SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 4990)	Nessus	SuSE Local Security Checks	medium
29872	Debian DSA-1453-1 : tomcat5 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
29856	Debian DSA-1447-1 : tomcat5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
28258	Fedora 8 : tomcat5-5.5.25-1jpp.1.fc8 (2007-3474)	Nessus	Fedora Local Security Checks	medium
28257	Fedora 7 : tomcat5-5.5.25-1jpp.1.fc7 (2007-3456)	Nessus	Fedora Local Security Checks	medium
26190	RHEL 5 : tomcat (RHSA-2007:0871)	Nessus	Red Hat Local Security Checks	medium
4167	Apache Tomcat < 5.5.25 / 6.0.x < 6.0.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
4564	Mac OS X < 10.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2007-3385

high

Tenable Plugins

medium

medium

medium

medium

critical

critical

medium

medium

high

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical