Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

From Red Hat Security Advisory 2008:0648 :

Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232)

An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947)

A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370)

An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process.
(CVE-2008-2938)

Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues.

An updated jbossweb package that fixes various security issues is now available for JBoss Enterprise Application Platform (JBoss EAP) 4.2 and 4.3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

JBoss Web Server (jbossweb) is an enterprise ready web server designed for medium and large applications, is based on Apache Tomcat, and is embedded into JBoss Application Server. It provides organizations with a single deployment platform for JavaServer Pages (JSP) and Java Servlet technologies, Microsoft(r) .NET, PHP, and CGI.

A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370)

An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the jbossweb process.
(CVE-2008-2938)

Users of jbossweb should upgrade to this updated package, which contains backported patches to resolve these issues.

A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232)

An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947)

A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370)

An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process.
(CVE-2008-2938)

Updated tomcat packages that fix multiple security issues are now available for Red Hat Network Satellite Server.

This update has been rated as having low security impact by the Red Hat Security Response Team.

This update corrects several security vulnerabilities in the Tomcat component shipped as part of Red Hat Network Satellite Server. In a typical operating environment, Tomcat is not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments.

Multiple flaws were fixed in the Apache Tomcat package.
(CVE-2008-1232, CVE-2008-1947, CVE-2008-2370, CVE-2008-2938, CVE-2008-3271)

Users of Red Hat Network Satellite Server 5.0 or 5.1 are advised to update to these Tomcat packages which resolve these issues.

Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232)

An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947)

A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially crafted request parameter to access protected web resources. (CVE-2008-2370)

An additional traversal vulnerability was discovered when the 'allowLinking' and 'URIencoding' settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process.
(CVE-2008-2938)

Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues.

Websphere has been updated to version 2.1.0.1 to fix several security vulnerabilities in the included subprojects, such as Apache Geronimo and Tomcat. (CVE-2007-0184 / CVE-2007-0185 / CVE-2007-2377 / CVE-2007-2449 / CVE-2007-2450 / CVE-2007-3382 / CVE-2007-3385 / CVE-2007-3386 / CVE-2007-5333 / CVE-2007-5342 / CVE-2007-5461 / CVE-2007-5613 / CVE-2007-5615 / CVE-2007-6286 / CVE-2008-0002 / CVE-2008-1232 / CVE-2008-1947 / CVE-2008-2370 / CVE-2008-2938)

This update of tomcat fixes another directory traversal bug which occurs when allowLinking and UTF-8 are enabled. (CVE-2008-2938)

A number of vulnerabilities have been discovered in the Apache Tomcat server :

The default catalina.policy in the JULI logging component did not restrict certain permissions for web applications which could allow a remote attacker to modify logging configuration options and overwrite arbitrary files (CVE-2007-5342).

A cross-site scripting vulnerability was found in the HttpServletResponse.sendError() method which could allow a remote attacker to inject arbitrary web script or HTML via forged HTTP headers (CVE-2008-1232).

A cross-site scripting vulnerability was found in the host manager application that could allow a remote attacker to inject arbitrary web script or HTML via the hostname parameter (CVE-2008-1947).

A traversal vulnerability was found when using a RequestDispatcher in combination with a servlet or JSP that could allow a remote attacker to utilize a specially crafted request parameter to access protected web resources (CVE-2008-2370).

A traversal vulnerability was found when the 'allowLinking' and 'URIencoding' settings were actived which could allow a remote attacker to use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process (CVE-2008-2938).

The updated packages have been patched to correct these issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

- Mon Sep 15 2008 David Walluck <dwalluck at redhat.com>     0:5.5.27-0jpp.2

    - add commons-io symlink

    - Mon Sep 15 2008 David Walluck <dwalluck at redhat.com>       0:5.5.27-0jpp.1

    - 5.5.27 Resolves: rhbz#456120 Resolves: rhbz#457934       Resolves: rhbz#446393 Resolves: rhbz#457597

  - Tue Feb 12 2008 Devrim GUNDUZ <devrim at     commandprompt.com> 0:5.5.26-1jpp.2

    - Rebuilt

    - Fri Feb 8 2008 Devrim GUNDUZ <devrim at       commandprompt.com> 0:5.5.26-1jpp.1

    - Update to new upstream version, which also fixes the       following :

    - CVE-2007-5342

    - CVE-2007-5333

    - CVE-2007-5461

    - CVE-2007-6286

    - Removed patch20, now in upstream.

    - Sat Jan 5 2008 Devrim GUNDUZ <devrim at       commandprompt.com> 0:5.5.25-2jpp.2

    - Fix for bz #153187

    - Fix init script for bz #380921

    - Fix tomcat5.conf and spec file for bz #253605

    - Fix for bz #426850

    - Fix for bz #312561

    - Fix init script, per bz #247077

    - Fix builds on alpha, per bz #253827

    - Thu Nov 15 2007 Devrim GUNDUZ <devrim at       commandprompt.com> 0:5.5.25-1jpp.1

    - Updated to 5.5.25, to fix the following issues :

    - CVE-2007-1355

    - CVE-2007-3386

    - CVE-2007-3385

    - CVE-2007-3382

    - CVE-2007-2450, RH bugzilla #244808, #244810, #244812,       #363081

    - CVE-2007-2449, RH bugzilla #244810, #244812, #244804,       #363081

    - Applied patch(20) for RH bugzilla #333791,       CVE-2007-5461

    - Applied patch(21) for RH bugzilla #244803, #244812,       #363081, CVE-2007-1358

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Sep 15 2008 David Walluck <dwalluck at redhat.com>     0:5.5.27-0jpp.2

    - add commons-io symlink

    - Mon Sep 15 2008 David Walluck <dwalluck at redhat.com>       0:5.5.27-0jpp.1

    - 5.5.27 Resolves: rhbz#456120 Resolves: rhbz#457934       Resolves: rhbz#446393 Resolves: rhbz#457597

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes several security-related issues. In addition, this release fixes several user-reported problems related to the startup scripts and file layout.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apache Tomcat running on the remote host is affected by a directory traversal vulnerability due to an issue with the UTF-8 charset implementation within the underlying JVM. An unauthenticated, remote attacker can exploit this, by encoding directory traversal sequences as UTF-8 in a request, to view arbitrary files on the remote host.

Note that successful exploitation requires that a context be configured with 'allowLinking' set to 'true' and the connector with 'URIEncoding' set to 'UTF-8', neither of which is a default setting.

The version of Apache Tomcat running on the remote host is affected by a directory traversal vulnerability due to an issue with the UTF-8 charset implementation within the underlying JVM. An unauthenticated, remote attacker can exploit this, by encoding directory traversal sequences as UTF-8 in a request, to view arbitrary files on the remote host. 

Note that successful exploitation requires that a context be configured with 'allowLinking' set to 'true' and the connector with 'URIEncoding' set to 'UTF-8', neither of which is a default setting.

The version of Apache Tomcat installed on the remote host is affected by a directory traversal issue.  By encoding directory traversal sequences as UTF-8 in a request, an unauthenticated remote attacker can leverage this issue to view arbitrary files on the remote host.  Note that successful exploitation requires that a context be configured with 'allowLinking' set to 'true' and the connector with 'URIEncoding' set to 'UTF-8', neither of which is a default setting.

ID	Name	Product	Family	Severity
67733	Oracle Linux 5 : tomcat (ELSA-2008-0648)	Nessus	Oracle Linux Local Security Checks	medium
63868	RHEL 4 / 5 : jbossweb (RHSA-2008:0877)	Nessus	Red Hat Local Security Checks	medium
60470	Scientific Linux Security Update : tomcat on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43842	RHEL 4 : tomcat in Satellite Server (RHSA-2008:1007)	Nessus	Red Hat Local Security Checks	medium
43703	CentOS 5 : tomcat5 (CESA-2008:0648)	Nessus	CentOS Local Security Checks	medium
41596	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 5850)	Nessus	SuSE Local Security Checks	high
41238	SuSE9 Security Update : Tomcat (YOU Patch Number 12232)	Nessus	SuSE Local Security Checks	medium
40143	openSUSE Security Update : tomcat6 (tomcat6-161)	Nessus	SuSE Local Security Checks	medium
36926	Mandriva Linux Security Advisory : tomcat5 (MDVSA-2008:188)	Nessus	Mandriva Local Security Checks	medium
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	critical
34227	Fedora 8 : tomcat5-5.5.27-0jpp.2.fc8 (2008-8130)	Nessus	Fedora Local Security Checks	medium
34226	Fedora 9 : tomcat5-5.5.27-0jpp.2.fc9 (2008-8113)	Nessus	Fedora Local Security Checks	medium
34185	Fedora 9 : tomcat6-6.0.18-1.1.fc9 (2008-7977)	Nessus	Fedora Local Security Checks	medium
34168	openSUSE 10 Security Update : tomcat55 (tomcat55-5547)	Nessus	SuSE Local Security Checks	medium
34155	openSUSE 10 Security Update : tomcat5 (tomcat5-5542)	Nessus	SuSE Local Security Checks	medium
34154	SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 5539)	Nessus	SuSE Local Security Checks	medium
34057	RHEL 5 : tomcat (RHSA-2008:0648)	Nessus	Red Hat Local Security Checks	medium
4621	Apache Tomcat 4.1.x < 4.1.38 / 5.5.x < 5.5.27 / 6.0.x < 6.0.18 Linking UTF-8 Traversal Arbitrary File Access	Nessus Network Monitor	Web Servers	medium
33866	Apache Tomcat allowLinking UTF-8 Traversal Arbitrary File Access	Nessus	CGI abuses	medium
800620	Apache Tomcat < 6.0.18 UTF-8 Directory Traversal Arbitrary File Access	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2008-2938

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium