CVE-2009-0783

MEDIUM

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

References

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

http://marc.info/?l=bugtraq&m=127420533226623&w=2

http://marc.info/?l=bugtraq&m=129070310906557&w=2

http://marc.info/?l=bugtraq&m=136485229118404&w=2

http://secunia.com/advisories/35685

http://secunia.com/advisories/35788

http://secunia.com/advisories/37460

http://secunia.com/advisories/42368

http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1

http://support.apple.com/kb/HT4077

http://svn.apache.org/viewvc?rev=652592&view=rev

http://svn.apache.org/viewvc?rev=681156&view=rev

http://svn.apache.org/viewvc?rev=739522&view=rev

http://svn.apache.org/viewvc?rev=781542&view=rev

http://svn.apache.org/viewvc?rev=781708&view=rev

http://tomcat.apache.org/security-4.html

http://tomcat.apache.org/security-5.html

http://tomcat.apache.org/security-6.html

http://www.debian.org/security/2011/dsa-2207

http://www.mandriva.com/security/advisories?name=MDVSA-2009:136

http://www.mandriva.com/security/advisories?name=MDVSA-2009:138

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

http://www.securityfocus.com/archive/1/504090/100/0/threaded

http://www.securityfocus.com/archive/1/507985/100/0/threaded

http://www.securityfocus.com/bid/35416

http://www.securitytracker.com/id?1022336

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

http://www.vupen.com/english/advisories/2009/1856

http://www.vupen.com/english/advisories/2009/3316

http://www.vupen.com/english/advisories/2010/3056

https://exchange.xforce.ibmcloud.com/vulnerabilities/51195

https://issues.apache.org/bugzilla/show_bug.cgi?id=29936

https://issues.apache.org/bugzilla/show_bug.cgi?id=45933

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html

Details

Source: MITRE

Published: 2009-06-05

Updated: 2019-10-09

Type: CWE-200

Risk Information

CVSS v2.0

Base Score: 4.6

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3.0

Base Score: 4.2

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Impact Score: 3.4

Exploitability Score: 0.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from 4.1.0 to 4.1.39 (inclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from 5.5.0 to 5.5.27 (inclusive)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from 6.0.0 to 6.0.18 (inclusive)

Tenable Plugins

View all (36 total)

IDNameProductFamilySeverity
89117VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)NessusMisc.
critical
67895Oracle Linux 5 : tomcat (ELSA-2009-1164)NessusOracle Linux Local Security Checks
medium
63885RHEL 4 : JBoss EAP (RHSA-2009:1146)NessusRed Hat Local Security Checks
medium
63884RHEL 5 : JBoss EAP (RHSA-2009:1145)NessusRed Hat Local Security Checks
medium
63883RHEL 4 : JBoss EAP (RHSA-2009:1144)NessusRed Hat Local Security Checks
medium
63882RHEL 5 : JBoss EAP (RHSA-2009:1143)NessusRed Hat Local Security Checks
medium
60621Scientific Linux Security Update : tomcat on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
59677GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
53212Debian DSA-2207-1 : tomcat5.5 - several vulnerabilitiesNessusDebian Local Security Checks
medium
49206Mandriva Linux Security Advisory : tomcat5 (MDVSA-2010:176)NessusMandriva Local Security Checks
medium
46753Apache Tomcat < 4.1.40 / 5.5.28 / 6.0.20 Multiple VulnerabilitiesNessusWeb Servers
medium
5489Mac OS X < 10.6.3 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
5489Mac OS X < 10.6.3 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
45373Mac OS X Multiple Vulnerabilities (Security Update 2010-002)NessusMacOS X Local Security Checks
critical
45372Mac OS X 10.6.x < 10.6.3 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
43845RHEL 4 : tomcat in Satellite Server (RHSA-2009:1617)NessusRed Hat Local Security Checks
medium
43844RHEL 4 : tomcat in Satellite Server (RHSA-2009:1616)NessusRed Hat Local Security Checks
medium
43770CentOS 5 : tomcat (CESA-2009:1164)NessusCentOS Local Security Checks
medium
42903Fedora 11 : tomcat6-6.0.20-1.fc11 (2009-11374)NessusFedora Local Security Checks
medium
42902Fedora 10 : tomcat6-6.0.20-1.fc10 (2009-11356)NessusFedora Local Security Checks
medium
42901Fedora 12 : tomcat6-6.0.20-1.fc12 (2009-11352)NessusFedora Local Security Checks
medium
42870VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.NessusVMware ESX Local Security Checks
critical
42037openSUSE 10 Security Update : tomcat55 (tomcat55-6369)NessusSuSE Local Security Checks
medium
41592SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 6352)NessusSuSE Local Security Checks
medium
41314SuSE9 Security Update : Tomcat (YOU Patch Number 12460)NessusSuSE Local Security Checks
medium
40342RHEL 5 : tomcat (RHSA-2009:1164)NessusRed Hat Local Security Checks
medium
40316openSUSE Security Update : tomcat6 (tomcat6-999)NessusSuSE Local Security Checks
medium
40144openSUSE Security Update : tomcat6 (tomcat6-999)NessusSuSE Local Security Checks
medium
39486Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:138)NessusMandriva Local Security Checks
medium
39485Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:136)NessusMandriva Local Security Checks
medium
39479Apache Tomcat Cross-Application File ManipulationNessusWeb Servers
medium
39419Ubuntu 8.10 / 9.04 : tomcat6 vulnerabilities (USN-788-1)NessusUbuntu Local Security Checks
medium
5044Apache Tomcat 4.1.x < 4.1.40 / 5.5.x < 5.5.28 / 6.0.x < 6.0.20 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
5044Apache Tomcat 4.1.x < 4.1.40 / 5.5.x < 5.5.28 / 6.0.x < 6.0.20 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
800598Apache Tomcat < 4.1.40 / 5.5.28 / 6.0.20 Multiple VulnerabilitiesLog Correlation EngineWeb Servers
medium
800598Apache Tomcat < 4.1.40 / 5.5.28 / 6.0.20 Multiple VulnerabilitiesLog Correlation EngineWeb Servers
medium