Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 6.0.14. It is, therefore, affected by the following vulnerabilities :

  - Cross-site scripting (XSS) vulnerabilities exists due     to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker     can exploit this, by convincing a user to click a specially     crafted URL, to execute arbitrary script code in a user's     browser session. (CVE-2007-2449, CVE-2007-2450,     CVE-2007-3386)

  - Session hijacking vulnerabilities exists in Tomcat due to     incorrect handling of specific special characters in cookie     values. In certain cases an attacker could leverage this     to leak sensitive information, such as the session ID.
    (CVE-2007-3382, CVE-2007-3385)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0871 :

Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and Java Server Pages technologies.

Tomcat was found treating single quote characters -- ' -- as delimiters in cookies. This could allow remote attackers to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3382).

It was reported Tomcat did not properly handle the following character sequence in a cookie: \' (a backslash followed by a double-quote). It was possible remote attackers could use this failure to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3385).

A cross-site scripting (XSS) vulnerability existed in the Host Manager Servlet. This allowed remote attackers to inject arbitrary HTML and web script via crafted requests (CVE-2007-3386).

Users of Tomcat should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

According to its self-reported version number, the instance Apache Tomcat running on the remote host is 5.0.x equal to or prior to 5.0.30 or 5.5.x prior to 5.5.25. It is, therefore, affected by multiple vulnerabilities :

  - An error exists in several JSP example files that allows     script injection via URLs using the ';' character.
    (CVE-2007-2449)

  - The Manager and Host Manager applications do not     properly sanitize the 'filename' parameter of the     '/manager/html/upload' script, which can lead to cross-     site scripting attacks. (CVE-2007-2450)

  - An error exists in the handling of cookie values     containing single quotes which Tomcat treats as     delimiters. This can allow disclosure of sensitive     information such as session IDs. (CVE-2007-3382)

  - An error exists in the handling of cookie values     containing backslashes which Tomcat treats as     delimiters. This can allow disclosure of sensitive     information such as session IDs. (CVE-2007-3385)

  - An error exists in the Host Manager application which     allows script injection. (CVE-2007-3386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Tomcat is a servlet container for Java Servlet and Java Server Pages technologies.

Tomcat was found treating single quote characters -- ' -- as delimiters in cookies. This could allow remote attackers to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3382).

It was reported Tomcat did not properly handle the following character sequence in a cookie: \' (a backslash followed by a double-quote). It was possible remote attackers could use this failure to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3385).

A cross-site scripting (XSS) vulnerability existed in the Host Manager Servlet. This allowed remote attackers to inject arbitrary HTML and web script via crafted requests (CVE-2007-3386).

Users of Tomcat should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

Websphere has been updated to version 2.1.0.1 to fix several security vulnerabilities in the included subprojects, such as Apache Geronimo and Tomcat. (CVE-2007-0184 / CVE-2007-0185 / CVE-2007-2377 / CVE-2007-2449 / CVE-2007-2450 / CVE-2007-3382 / CVE-2007-3385 / CVE-2007-3386 / CVE-2007-5333 / CVE-2007-5342 / CVE-2007-5461 / CVE-2007-5613 / CVE-2007-5615 / CVE-2007-6286 / CVE-2008-0002 / CVE-2008-1232 / CVE-2008-1947 / CVE-2008-2370 / CVE-2008-2938)

A number of vulnerabilities were found in Tomcat :

A directory traversal vulnerability, when using certain proxy modules, allows a remote attacker to read arbitrary files via a .. (dot dot) sequence with various slash, backslash, or url-encoded backslash characters (CVE-2007-0450; affects Mandriva Linux 2007.1 only).

Multiple cross-site scripting vulnerabilities in certain JSP files allow remote attackers to inject arbitrary web script or HTML (CVE-2007-2449).

Multiple cross-site scripting vulnerabilities in the Manager and Host Manager web applications allow remote authenticated users to inject arbitrary web script or HTML (CVE-2007-2450).

Tomcat treated single quotes as delimiters in cookies, which could cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks (CVE-2007-3382).

Tomcat did not properly handle the ' character sequence in a cookie value, which could cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks (CVE-2007-3385).

A cross-site scripting vulnerability in the Host Manager servlet allowed remote attackers to inject arbitrary HTML and web script via crafted attacks (CVE-2007-3386).

Finally, an absolute path traversal vulnerability, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag (CVE-2007-5461).

The updated packages have been patched to correct these issues.

Fixed various issues in tomcat :

  - CVE-2007-3382: Handling of cookies containing a '     character

  - CVE-2007-3385: Handling of \' in cookies

  - CVE-2007-5641: tomcat path traversal / information leak

  - CVE-2007-1860: directory traversal

  - CVE-2007-3386: tomcat XSS 

  - CVE-2007-5342: insufficient access restrictions

Additionally the dbcp namespace in commons-dbcp.jar was fixed.

Several remote vulnerabilities have been discovered in the Tomcat servlet and JSP engine. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3382     It was discovered that single quotes (') in cookies were     treated as a delimiter, which could lead to an     information leak.

  - CVE-2007-3385     It was discovered that the character sequence \' in     cookies was handled incorrectly, which could lead to an     information leak.

  - CVE-2007-3386     It was discovered that the host manager servlet     performed insufficient input validation, which could     lead to a cross-site scripting attack.

  - CVE-2007-5342     It was discovered that the JULI logging component did     not restrict its target path, resulting in potential     denial of service through file overwrites.

  - CVE-2007-5461     It was discovered that the WebDAV servlet is vulnerable     to absolute path traversal.

Updated Tomcat5 packages that fix several security bugs are now available for Fedora Core 8.

This update includes fixes to the following :

  - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450

    - CVE-2007-2449

    - CVE-2007-5461

    - CVE-2007-1358

All users of tomcat are advised to update to these packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Tomcat5 packages that fix several security bugs are now available for Fedora Core 7.

This update includes fixes to the following :

  - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450

    - CVE-2007-2449

    - CVE-2007-5461

    - CVE-2007-1358

All users of tomcat are advised to update to these packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running the Apache Tomcat server.  This version of Tomcat is vulnerable to two distinct classes of flaws.  First, the application is vulnerable to a Cross-Site Scripting flaw in the 'aliases' parameter of the '/host-manager/html/add' script.  Second, the application is vulnerable to a number of flaws that would reveal sensitive information.  An attacker exploiting these flaws would be able to either execute code within client browsers or gain information that would be useful for further attacks against Tomcat. 

ID	Name	Product	Family	Severity
121113	Apache Tomcat < 6.0.14 Multiple Vulnerabilities	Nessus	Web Servers	medium
67564	Oracle Linux 5 : tomcat (ELSA-2007-0871)	Nessus	Oracle Linux Local Security Checks	medium
51059	Apache Tomcat 5.0.x <= 5.0.30 / 5.5.x < 5.5.25 Multiple Vulnerabilities	Nessus	Web Servers	medium
43651	CentOS 5 : tomcat (CESA-2007:0871)	Nessus	CentOS Local Security Checks	medium
41596	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 5850)	Nessus	SuSE Local Security Checks	high
38147	Mandrake Linux Security Advisory : tomcat5 (MDKSA-2007:241)	Nessus	Mandriva Local Security Checks	medium
31338	openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-4997)	Nessus	SuSE Local Security Checks	medium
29856	Debian DSA-1447-1 : tomcat5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
28258	Fedora 8 : tomcat5-5.5.25-1jpp.1.fc8 (2007-3474)	Nessus	Fedora Local Security Checks	medium
28257	Fedora 7 : tomcat5-5.5.25-1jpp.1.fc7 (2007-3456)	Nessus	Fedora Local Security Checks	medium
26190	RHEL 5 : tomcat (RHSA-2007:0871)	Nessus	Red Hat Local Security Checks	medium
4167	Apache Tomcat < 5.5.25 / 6.0.x < 6.0.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
800624	Apache Tomcat <= 6.0.13 / 5.5.24 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2007-3386

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium