Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0897 advisory.

  - tomcat: information disclosure in authentication headers (CVE-2010-1157)

  - httpd mod_cache, mod_dav: DoS (httpd child process crash) by parsing URI structure with missing path     segments (CVE-2010-1452)

  - apr-util: high memory consumption in apr_brigade_split_line() (CVE-2010-1623)

  - tomcat: file permission bypass flaw (CVE-2010-3718)

  - tomcat: cross-site-scripting vulnerability in the manager application (CVE-2010-4172)

  - tomcat: XSS vulnerability in HTML Manager interface (CVE-2011-0013)

  - apr: unconstrained recursion in apr_fnmatch (CVE-2011-0419)

  - httpd: mod_proxy_ajp worker moved to error state when timeout exceeded (CVE-2012-4557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0791 advisory.

    - CVE-2010-4172, CVE-2010-3718, CVE-2011-0013, CVE-2010-4476,
    - CVE-2011-0534
    - CVE-2010-4172, CVE-2011-0013, CVE-2010-3718 commented out

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This tomcat6 update fixes :

  - CVE-2010-3718: CVSS v2 Base Score: 4.0     (AV:N/AC:H/Au:N/C:P/I:P/A:N): Design Error     (CWE-DesignError)

  - CVE-2011-0013: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): XSS (CWE-79)

  - CVE-2011-0534: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1845 advisory.

    - Resolves: CVE-2011-0013 rhbz 675931
    - Resolves: CVE-2010-3718 rhbz 675931
    - Resolves: CVE-2011-1184 rhbz 744983

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system.
(CVE-2010-3718)

A cross-site scripting (XSS) flaw was found in the Manager application, used for managing web applications on Apache Tomcat. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages. (CVE-2011-0013)

Multiple flaws were found in the way Tomcat handled HTTP DIGEST authentication. These flaws weakened the Tomcat HTTP DIGEST authentication implementation, subjecting it to some of the weaknesses of HTTP BASIC authentication, for example, allowing remote attackers to perform session replay attacks. (CVE-2011-1184)

A flaw was found in the Tomcat MemoryUserDatabase. If a runtime exception occurred when creating a new user with a JMX client, that user's password was logged to Tomcat log files. Note: By default, only administrators have access to such log files. (CVE-2011-2204)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system.
(CVE-2010-3718)

A cross-site scripting (XSS) flaw was found in the Manager application, used for managing web applications on Tomcat. If a remote attacker could trick a user who is logged into the Manager application into visiting a specially crafted URL, the attacker could perform Manager application tasks with the privileges of the logged in user.
(CVE-2010-4172)

A second cross-site scripting (XSS) flaw was found in the Manager application. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages. (CVE-2011-0013)

This update also fixes the following bugs :

  - A bug in the 'tomcat6' init script prevented additional     Tomcat instances from starting. As well, running     'service tomcat6 start' caused configuration options     applied from '/etc/sysconfig/tomcat6' to be overwritten     with those from '/etc/tomcat6/tomcat6.conf'. With this     update, multiple instances of Tomcat run as expected.
    (BZ#636997)

  - The '/usr/share/java/' directory was missing a symbolic     link to the '/usr/share/tomcat6/bin/tomcat-juli.jar'     library. Because this library was mandatory for certain     operations (such as running the Jasper JSP precompiler),     the 'build-jar-repository' command was unable to compose     a valid classpath. With this update, the missing     symbolic link has been added. (BZ#661244)

  - Previously, the 'tomcat6' init script failed to start     Tomcat with a 'This account is currently not available.'     message when Tomcat was configured to run under a user     that did not have a valid shell configured as a login     shell. This update modifies the init script to work     correctly regardless of the daemon user's login shell.
    Additionally, these new tomcat6 packages now set     '/sbin/nologin' as the login shell for the 'tomcat' user     upon installation, as recommended by deployment best     practices. (BZ#678671)

  - Some standard Tomcat directories were missing write     permissions for the 'tomcat' group, which could cause     certain applications to fail with errors such as 'No     output folder'. This update adds write permissions for     the 'tomcat' group to the affected directories.
    (BZ#643809)

  - The '/usr/sbin/tomcat6' wrapper script used a hard-coded     path to the 'catalina.out' file, which may have caused     problems (such as for logging init script output) if     Tomcat was being run with a user other than 'tomcat' and     with CATALINA_BASE set to a directory other than the     default. (BZ#695284, BZ#697504)

  - Stopping Tomcat could have resulted in traceback errors     being logged to 'catalina.out' when certain web     applications were deployed. (BZ#698624)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1845 advisory.

  - tomcat: file permission bypass flaw (CVE-2010-3718)

  - tomcat: XSS vulnerability in HTML Manager interface (CVE-2011-0013)

  - tomcat: Multiple weaknesses in HTTP DIGEST authentication (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,     CVE-2011-5064)

  - tomcat: password disclosure vulnerability (CVE-2011-2204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system.
(CVE-2010-3718)

A cross-site scripting (XSS) flaw was found in the Manager application, used for managing web applications on Apache Tomcat. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages. (CVE-2011-0013)

Multiple flaws were found in the way Tomcat handled HTTP DIGEST authentication. These flaws weakened the Tomcat HTTP DIGEST authentication implementation, subjecting it to some of the weaknesses of HTTP BASIC authentication, for example, allowing remote attackers to perform session replay attacks. (CVE-2011-1184)

A flaw was found in the Tomcat MemoryUserDatabase. If a runtime exception occurred when creating a new user with a JMX client, that user's password was logged to Tomcat log files. Note: By default, only administrators have access to such log files. (CVE-2011-2204)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

Fixes for: CVE-2011-3190 - authentication bypass and information disclosure CVE-2011-2526 - send file validation CVE-2011-2204 - password disclosure vulnerability JAVA_HOME setting in tomcat6.conf

CVE-2011-0534, CVE-2011-0013, CVE-2010-3718

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreFoundation
  - CoreMedia
  - File Systems
  - IOGraphics
  - iChat Server
  - Mailman
  - MediaKit
  - PHP
  - postfix
  - python
  - QuickTime
  - Tomcat
  - User Documentation
  - Web Server
  - X11

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0791 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer     Pages (JSP) technologies.

    It was found that web applications could modify the location of the Tomcat     host's work directory. As web applications deployed on Tomcat have read and     write access to this directory, a malicious web application could use this     flaw to trick Tomcat into giving it read and write access to an arbitrary     directory on the file system. (CVE-2010-3718)

    A cross-site scripting (XSS) flaw was found in the Manager application,     used for managing web applications on Tomcat. If a remote attacker could     trick a user who is logged into the Manager application into visiting a     specially-crafted URL, the attacker could perform Manager application tasks     with the privileges of the logged in user. (CVE-2010-4172)

    A second cross-site scripting (XSS) flaw was found in the Manager     application. A malicious web application could use this flaw to conduct an     XSS attack, leading to arbitrary web script execution with the privileges     of victims who are logged into and viewing Manager application web pages.
    (CVE-2011-0013)

    This update also fixes the following bugs:

    * A bug in the tomcat6 init script prevented additional Tomcat instances     from starting. As well, running service tomcat6 start caused     configuration options applied from /etc/sysconfig/tomcat6 to be     overwritten with those from /etc/tomcat6/tomcat6.conf. With this update,     multiple instances of Tomcat run as expected. (BZ#636997)

    * The /usr/share/java/ directory was missing a symbolic link to the     /usr/share/tomcat6/bin/tomcat-juli.jar library. Because this library was     mandatory for certain operations (such as running the Jasper JSP     precompiler), the build-jar-repository command was unable to compose a     valid classpath. With this update, the missing symbolic link has been     added. (BZ#661244)

    * Previously, the tomcat6 init script failed to start Tomcat with a This     account is currently not available. message when Tomcat was configured to     run under a user that did not have a valid shell configured as a login     shell. This update modifies the init script to work correctly regardless of     the daemon user's login shell. Additionally, these new tomcat6 packages now     set /sbin/nologin as the login shell for the tomcat user upon     installation, as recommended by deployment best practices. (BZ#678671)

    * Some standard Tomcat directories were missing write permissions for the     tomcat group, which could cause certain applications to fail with errors     such as No output folder. This update adds write permissions for the     tomcat group to the affected directories. (BZ#643809)

    * The /usr/sbin/tomcat6 wrapper script used a hard-coded path to the     catalina.out file, which may have caused problems (such as for logging     init script output) if Tomcat was being run with a user other than tomcat     and with CATALINA_BASE set to a directory other than the default.
    (BZ#695284, BZ#697504)

    * Stopping Tomcat could have resulted in traceback errors being logged to     catalina.out when certain web applications were deployed. (BZ#698624)

    Users of Tomcat should upgrade to these updated packages, which contain     backported patches to correct these issues. Tomcat must be restarted for     this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the Tomcat SecurityManager did not properly restrict the working directory. An attacker could use this flaw to read or write files outside of the intended working directory.
(CVE-2010-3718)

It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain.
(CVE-2011-0013)

It was discovered that Tomcat incorrectly enforced the maxHttpHeaderSize limit in certain configurations. A remote attacker could use this flaw to cause Tomcat to consume all available memory, resulting in a denial of service. (CVE-2011-0534).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Apache Tomcat Local bypass of security manger file     permissions. (CVE-2010-3718)

  - Apache Tomcat Manager XSS vulnerability. (CVE-2011-0013)

This tomcat6 update fixes :

  - CVE-2010-3718: CVSS v2 Base Score: 4.0     (AV:N/AC:H/Au:N/C:P/I:P/A:N): Design Error     (CWE-DesignError)

  - CVE-2011-0013: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): XSS (CWE-79)

Multiple vulnerabilities has been found and corrected in tomcat5 :

When running under a SecurityManager, access to the file system is limited but web applications are granted read/write permissions to the work directory. This directory is used for a variety of temporary files such as the intermediate files generated when compiling JSPs to Servlets. The location of the work directory is specified by a ServletContect attribute that is meant to be read-only to web applications. However, due to a coding error, the read-only setting was not applied. Therefore, a malicious web application may modify the attribute before Tomcat applies the file permissions. This can be used to grant read/write permissions to any area on the file system which a malicious web application may then take advantage of. This vulnerability is only applicable when hosting web applications from untrusted sources such as shared hosting environments (CVE-2010-3718).

The HTML Manager interface displayed web application provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administrative user when viewing the manager pages (CVE-2011-0013).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct these issues.

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.30. It is, therefore, affected by multiple vulnerabilities :

  - An error in the access restriction on a 'ServletContext'     attribute that holds the location of the work directory     in Tomcat's SecurityManager. A malicious web application     can modify the location of the working directory which     then allows improper read and write access to arbitrary     files and directories in the context of Tomcat.
    (CVE-2010-3718)

  - An input validation error exists in the Manager     application in that it fails to filter the 'sort' and     'orderBy' input parameters. (CVE-2010-4172)

  - The default configuration does not include the HTTPOnly     flag in a Set-Cookie header, which makes it easier for     remote attackers to hijack a session via script access     to a cookie. (CVE-2010-4312)

  - An input validation error exists in the HTML manager     application in that it fails to filter various input     data before returning it to the browser. (CVE-2011-0013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine :

  - CVE-2010-3718     It was discovered that the SecurityManager     insufficiently restricted the working directory.

  - CVE-2011-0013     It was discovered that the HTML manager interface is     affected by cross-site scripting.

  - CVE-2011-0534     It was discovered that NIO connector performs     insufficient validation of the HTTP headers, which could     lead to denial of service.

The oldstable distribution (lenny) is not affected by these issues.

According to its self-reported version number, the instance of Apache Tomcat 7.x listening on the remote host is prior to 7.0.4. It is, therefore, affected by a security bypass vulnerability due to an error in the access restriction on a 'ServletContext' attribute which holds the location of the work directory in Tomcat's SecurityManager. A malicious web application can modify the location of the working directory which then allows improper read and write access to arbitrary files and directories in the context of Tomcat.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.30. It is, therefore, affected by multiple vulnerabilities:

 - An error in the access restriction on a 'ServletContext' attribute that holds the location of the work directory in Tomcat's SecurityManager. A malicious web application can modify the location of the working directory which then allows improper read and write access to arbitrary files and directories in the context of Tomcat. (CVE-2010-3718)

 - An input validation error exists in the Manager application in that it fails to filter the 'sort' and 'orderBy' input parameters. (CVE-2010-4172)

 - The default configuration does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. (CVE-2010-4312)

 - An input validation error exists in the HTML manager application in that it fails to filter various input data before returning it to the browser. (CVE-2011-0013)

Note that Nessus Network Monitor has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.4. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.4_security-7 advisory.

  - Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make     the ServletContext attribute read-only, which allows local web applications to read or write files outside     of the intended working directory, as demonstrated using a directory traversal attack. (CVE-2010-3718)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Apache Tomcat server listening on the remote host is 5.5.x prior to 5.5.30. It is, therefore, affected by multiple vulnerabilities :

  - An error in the access restriction on a 'ServletContext'     attribute which holds the location of the work     directory in Tomcat's SecurityManager. A remote attacker     may be able to modify the location of the working     directory which then allows improper read and write     access to arbitrary files and directories in the context     of Tomcat.(CVE-2010-3718)

  - An error exists in the handling of the     'Transfer-Encoding' header of a client request. This     error affects buffer recycling and may lead to the     disclosure of sensitive information or allow a denial     of service attack to be successful. (CVE-2010-2227)

  - An error exists in the handling of the '<realm-name>'     element in a web application's web.xml file. If the     element is missing from the web.xml file and the     application is using BASIC or DIGEST authentication,     Tomcat will include the server's hostname or IP address     in the 'WWW-Authenticate' header of the response.
    (CVE-2010-1157)

Note that Nessus did not actually test for the flaws but instead has relied on the version in Tomcat's banner or error page so this may be a false positive.

ID	Name	Product	Family	Severity
193971	RHEL 5 / 6 : JBoss Enterprise Web Server 1.0.2 update (Moderate) (RHSA-2011:0897)	Nessus	Red Hat Local Security Checks	medium
181039	Oracle Linux 6 : tomcat6 (ELSA-2011-0791)	Nessus	Oracle Linux Local Security Checks	medium
75761	openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0146-1)	Nessus	SuSE Local Security Checks	medium
68410	Oracle Linux 5 : tomcat5 (ELSA-2011-1845)	Nessus	Oracle Linux Local Security Checks	medium
61211	Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
61051	Scientific Linux Security Update : tomcat6 on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57356	RHEL 5 : tomcat5 (RHSA-2011:1845)	Nessus	Red Hat Local Security Checks	medium
57354	CentOS 5 : tomcat5 (CESA-2011:1845)	Nessus	CentOS Local Security Checks	medium
56573	Fedora 14 : tomcat6-6.0.26-27.fc14 (2011-13457)	Nessus	Fedora Local Security Checks	high
56481	Mac OS X Multiple Vulnerabilities (Security Update 2011-006)	Nessus	MacOS X Local Security Checks	critical
54601	RHEL 6 : tomcat6 (RHSA-2011:0791)	Nessus	Red Hat Local Security Checks	medium
53807	openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0146-1)	Nessus	SuSE Local Security Checks	medium
53221	Ubuntu 9.10 / 10.04 LTS / 10.10 : tomcat6 vulnerabilities (USN-1097-1)	Nessus	Ubuntu Local Security Checks	medium
52711	SuSE9 Security Update : Tomcat (YOU Patch Number 12687)	Nessus	SuSE Local Security Checks	medium
52525	SuSE 10 Security Update : Tomcat (ZYPP Patch Number 7337)	Nessus	SuSE Local Security Checks	medium
52035	Mandriva Linux Security Advisory : tomcat5 (MDVSA-2011:030)	Nessus	Mandriva Local Security Checks	medium
51975	Apache Tomcat 6.0.x < 6.0.30 Multiple Vulnerabilities	Nessus	Web Servers	medium
51959	Debian DSA-2160-1 : tomcat6 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
5792	Apache Tomcat 7.0.x < 7.0.4 SecurityManager Local Security Bypass	Nessus Network Monitor	Web Servers	medium
5789	Apache Tomcat 6.0.x < 6.0.30 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
51958	Apache Tomcat 7.0.0 < 7.0.4	Nessus	Web Servers	low
47749	Apache Tomcat 5.5.x < 5.5.30	Nessus	Web Servers	medium

Detections

Analytics

CVE-2010-3718

low

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

medium