GLSA-200804-10 : Tomcat: Multiple vulnerabilities

medium Nessus Plugin ID 31957
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 5

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200804-10 (Tomcat: Multiple vulnerabilities)

The following vulnerabilities were reported:
Delian Krustev discovered that the JULI logging component does not properly enforce access restrictions, allowing web application to add or overwrite files (CVE-2007-5342).
When the native APR connector is used, Tomcat does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of a duplicate copy of one of the recent requests (CVE-2007-6286).
If the processing or parameters is interrupted, i.e. by an exception, then it is possible for the parameters to be processed as part of later request (CVE-2008-0002).
An absolute path traversal vulnerability exists due to the way that WebDAV write requests are handled (CVE-2007-5461).
Tomcat does not properly handle double quote (') characters or %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks (CVE-2007-5333).
Impact :

These vulnerabilities can be exploited by:
a malicious web application to add or overwrite files with the permissions of the user running Tomcat.
a remote attacker to conduct session hijacking or disclose sensitive data.
Workaround :

There is no known workaround at this time.

Solution

All Tomcat 5.5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=www-servers/tomcat-5.5.26' All Tomcat 6.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=www-servers/tomcat-6.0.16'

See Also

https://security.gentoo.org/glsa/200804-10

Plugin Details

Severity: Medium

ID: 31957

File Name: gentoo_GLSA-200804-10.nasl

Version: 1.18

Type: local

Published: 4/17/2008

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: Medium

VPR Score: 5

CVSS v2.0

Base Score: 6.4

Temporal Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Temporal Vector: E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:tomcat, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/10/2008

Vulnerability Publication Date: 10/14/2007

Reference Information

CVE: CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286, CVE-2008-0002

GLSA: 200804-10

CWE: 22, 200, 264