Executive Summary
| Summary | |
|---|---|
| Title | New tomcat packages fix information exposure and cross site scripting |
| Informations | |||
|---|---|---|---|
| Name | DSA-246 | First vendor Publication | 2003-01-29 |
| Vendor | Debian | Last vendor Modification | 2003-01-29 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The developers of tomcat discovered several problems in tomcat version 3.x. The Common Vulnerabilities and Exposures project identifies the following problems: . CAN-2003-0042: A maliciously crafted request could return a directory listing even when an index.html, index.jsp, or other welcome file is present. File contents can be returned as well. . CAN-2003-0043: A malicious web application could read the contents of some files outside the web application via its web.xml file in spite of the presence of a security manager. The content of files that can be read as part of an XML document would be accessible. . CAN-2003-0044: A cross-site scripting vulnerability was discovered in the included sample web application that allows remote attackers to execute arbitrary script code. For the stable distribution (woody) this problem has been fixed in version 3.3a-4.1. The old stable distribution (potato) does not contain tomcat packages. For the unstable distribution (sid) this problem has been fixed in version 3.3.1a-1. We recommend that you upgrade your tomcat package. |
Original Source
| Url : http://www.debian.org/security/2003/dsa-246 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-05-05 | Name : HP-UX Update for Tomcat HPSBUX00249 File : nvt/gb_hp_ux_HPSBUX00249.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 246-1 (tomcat) File : nvt/deb_246_1.nasl |
| 2005-11-03 | Name : Apache Tomcat Directory Listing and File disclosure File : nvt/tomcat_directory_listing_and_file_disclosure.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 12232 | Apache Tomcat with JDK Arbitrary Directory/Source Disclosure |
| 12231 | Apache Tomcat web.xml Arbitrary File Access Jakarta Tomcat contains a flaw that may lead to an unauthorized information disclosure. The issue is due to an error when using trusted privileges to process the web.xml file. This flaw may allow a remote attacker to use web.xml to read arbitrary files in the web server, resulting in a loss of confidentiality. |
| 9204 | Apache Tomcat ROOT Application XSS Jakarta Tomcat contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate multiple variables in "ROOT" application. No further description is available. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
| 9203 | Apache Tomcat examples Application XSS Jakarta Tomcat contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate multiple variables in examples applications. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Apache Tomcat null byte directory listing attempt RuleID : 2061-community - Revision : 13 - Type : SERVER-APACHE |
| 2014-01-10 | Apache Tomcat null byte directory listing attempt RuleID : 2061 - Revision : 13 - Type : SERVER-APACHE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-11-09 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_3_3_2.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-246.nasl - Type : ACT_GATHER_INFO |
| 2003-03-22 | Name : The remote web server is affected by an information disclosure vulnerability. File : tomcat_directory_listing_and_file_disclosure.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:31:01 |
|
