4.3 - RHSA-2011:0791

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	tomcat6 security and bug fix update

Informations
Name	RHSA-2011:0791	First vendor Publication	2011-05-19
Vendor	RedHat	Last vendor Modification	2011-05-19
Severity (Vendor)	Moderate	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated tomcat6 packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Optional (v. 6) - noarch Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Enterprise Linux Server Optional (v. 6) - noarch Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Enterprise Linux Workstation Optional (v. 6) - noarch

3. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system. (CVE-2010-3718)

A cross-site scripting (XSS) flaw was found in the Manager application, used for managing web applications on Tomcat. If a remote attacker could trick a user who is logged into the Manager application into visiting a specially-crafted URL, the attacker could perform Manager application tasks with the privileges of the logged in user. (CVE-2010-4172)

A second cross-site scripting (XSS) flaw was found in the Manager application. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages. (CVE-2011-0013)

This update also fixes the following bugs:

* A bug in the "tomcat6" init script prevented additional Tomcat instances from starting. As well, running "service tomcat6 start" caused configuration options applied from "/etc/sysconfig/tomcat6" to be overwritten with those from "/etc/tomcat6/tomcat6.conf". With this update, multiple instances of Tomcat run as expected. (BZ#636997)

* The "/usr/share/java/" directory was missing a symbolic link to the "/usr/share/tomcat6/bin/tomcat-juli.jar" library. Because this library was mandatory for certain operations (such as running the Jasper JSP precompiler), the "build-jar-repository" command was unable to compose a valid classpath. With this update, the missing symbolic link has been added. (BZ#661244)

* Previously, the "tomcat6" init script failed to start Tomcat with a "This account is currently not available." message when Tomcat was configured to run under a user that did not have a valid shell configured as a login shell. This update modifies the init script to work correctly regardless of the daemon user's login shell. Additionally, these new tomcat6 packages now set "/sbin/nologin" as the login shell for the "tomcat" user upon installation, as recommended by deployment best practices. (BZ#678671)

* Some standard Tomcat directories were missing write permissions for the "tomcat" group, which could cause certain applications to fail with errors such as "No output folder". This update adds write permissions for the "tomcat" group to the affected directories. (BZ#643809)

* The "/usr/sbin/tomcat6" wrapper script used a hard-coded path to the "catalina.out" file, which may have caused problems (such as for logging init script output) if Tomcat was being run with a user other than "tomcat" and with CATALINA_BASE set to a directory other than the default. (BZ#695284, BZ#697504)

* Stopping Tomcat could have resulted in traceback errors being logged to "catalina.out" when certain web applications were deployed. (BZ#698624)

Users of Tomcat should upgrade to these updated packages, which contain backported patches to correct these issues. Tomcat must be restarted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

636997 - Additionally Created Instances of Tomcat are broken / don't work 643809 - Bad permissions on tomcat folders 656246 - CVE-2010-4172 tomcat: cross-site-scripting vulnerability in the manager application 661244 - Missing tomcat6-juli link in /usr/share/java 675786 - CVE-2011-0013 tomcat: XSS vulnerability in HTML Manager interface 675792 - CVE-2010-3718 tomcat: file permission bypass flaw 678671 - tomcat user requires login shell 695284 - catalina.out path hard-coded in /usr/sbin/tomcat6 697504 - tomcat6-6.0.wrapper redirects init script output to wrong place

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2011-0791.html

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12517

Oval ID:	oval:org.mitre.oval:def:12517
Title:	HP-UX Apache Web Server, Remote Information Disclosure, Cross-Site Scripting (XSS), Denial of Service (DoS)
Description:	Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-3718	Version:	12
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND filesets tests hpuxwsAPACHE.APACHE version is less than B.2.2.15.05 AND hpuxwsAPACHE.APACHE2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP version is less than B.2.2.15.05 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP2 version is less than B.2.2.15.05 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.11 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND filesets tests hpuxwsAPCH32.APACHE version is less than B.2.0.64.01 AND hpuxwsAPCH32.APACHE2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP version is less than B.2.0.64.01 AND hpuxwsAPCH32.WEBPROXY version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP2 version is less than B.2.0.64.01 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.11 AND filesets tests hpuxwsAPACHE.APACHE version is less than B.2.0.64.01 AND hpuxwsAPACHE.APACHE2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.0.64.01 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_JK version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.0.64.01 AND hpuxwsAPACHE.PHP version is less than B.2.0.64.01 AND hpuxwsAPACHE.PHP2 version is less than B.2.0.64.01 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND filesets tests hpuxwsAPACHE.APACHE version is less than B.2.2.15.05 AND hpuxwsAPACHE.APACHE2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP2 version is less than B.2.2.15.05 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND filesets tests hpuxwsAPCH32.APACHE version is less than B.2.0.64.01 AND hpuxwsAPCH32.APACHE2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.WEBPROXY version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP2 version is less than B.2.0.64.01

Definition Id: oval:org.mitre.oval:def:12878

Oval ID:	oval:org.mitre.oval:def:12878
Title:	HP-UX Apache Web Server, Remote Information Disclosure, Cross-Site Scripting (XSS), Denial of Service (DoS)
Description:	Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2011-0013	Version:	13
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND filesets tests hpuxwsAPACHE.APACHE version is less than B.2.2.15.05 AND hpuxwsAPACHE.APACHE2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP version is less than B.2.2.15.05 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP2 version is less than B.2.2.15.05 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.11 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND filesets tests hpuxwsAPCH32.APACHE version is less than B.2.0.64.01 AND hpuxwsAPCH32.APACHE2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP version is less than B.2.0.64.01 AND hpuxwsAPCH32.WEBPROXY version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP2 version is less than B.2.0.64.01 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.30.04 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.11 AND filesets tests hpuxwsAPACHE.APACHE version is less than B.2.0.64.01 AND hpuxwsAPACHE.APACHE2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.0.64.01 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_JK version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.0.64.01 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.0.64.01 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.0.64.01 AND hpuxwsAPACHE.PHP version is less than B.2.0.64.01 AND hpuxwsAPACHE.PHP2 version is less than B.2.0.64.01 OR Criteria meets HP Security Bulletin HPSBUX02645 HP Release B.11.23 AND filesets tests hpuxwsAPACHE.APACHE version is less than B.2.2.15.05 AND hpuxwsAPACHE.APACHE2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.2.15.05 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.2.15.05 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.2.15.05 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP version is less than B.2.2.15.05 AND hpuxwsAPACHE.PHP2 version is less than B.2.2.15.05 OR Criteria meets HP Security Bulletin HPSBUX02645 HP-UX B.11.31 AND filesets tests hpuxwsAPCH32.APACHE version is less than B.2.0.64.01 AND hpuxwsAPCH32.APACHE2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP version is less than B.2.0.64.01 AND hpuxwsAPCH32.AUTH_LDAP2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_JK2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL version is less than B.2.0.64.01 AND hpuxwsAPCH32.MOD_PERL2 version is less than B.2.0.64.01 AND hpuxwsAPCH32.WEBPROXY version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP version is less than B.2.0.64.01 AND hpuxwsAPCH32.PHP2 version is less than B.2.0.64.01

Definition Id: oval:org.mitre.oval:def:13494

Oval ID:	oval:org.mitre.oval:def:13494
Title:	USN-1048-1 -- tomcat6 vulnerability
Description:	It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
Family:	unix	Class:	patch
Reference(s):	USN-1048-1 CVE-2010-4172	Version:	5
Platform(s):	Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04	Product(s):	tomcat6
Definition Synopsis:
Release section Ubuntu 10.10 is installed AND Installed architecture is all AND Packages section libservlet2.5-java DPKG is earlier than 6.0.28-2ubuntu1.1 AND libtomcat6-java DPKG is earlier than 6.0.28-2ubuntu1.1 AND tomcat6-docs DPKG is earlier than 6.0.28-2ubuntu1.1 AND libservlet2.5-java-doc DPKG is earlier than 6.0.28-2ubuntu1.1 AND tomcat6 DPKG is earlier than 6.0.28-2ubuntu1.1 AND tomcat6-admin DPKG is earlier than 6.0.28-2ubuntu1.1 AND tomcat6-common DPKG is earlier than 6.0.28-2ubuntu1.1 AND tomcat6-user DPKG is earlier than 6.0.28-2ubuntu1.1 AND tomcat6-examples DPKG is earlier than 6.0.28-2ubuntu1.1 OR Release section Ubuntu 9.10 is installed AND Installed architecture is all AND Packages section libservlet2.5-java DPKG is earlier than 6.0.20-2ubuntu2.3 AND libtomcat6-java DPKG is earlier than 6.0.20-2ubuntu2.3 AND tomcat6-docs DPKG is earlier than 6.0.20-2ubuntu2.3 AND libservlet2.5-java-doc DPKG is earlier than 6.0.20-2ubuntu2.3 AND tomcat6 DPKG is earlier than 6.0.20-2ubuntu2.3 AND tomcat6-admin DPKG is earlier than 6.0.20-2ubuntu2.3 AND tomcat6-common DPKG is earlier than 6.0.20-2ubuntu2.3 AND tomcat6-user DPKG is earlier than 6.0.20-2ubuntu2.3 AND tomcat6-examples DPKG is earlier than 6.0.20-2ubuntu2.3 OR Release section Ubuntu 10.04 is installed AND Installed architecture is all AND Packages section libservlet2.5-java DPKG is earlier than 6.0.24-2ubuntu1.6 AND libtomcat6-java DPKG is earlier than 6.0.24-2ubuntu1.6 AND tomcat6-docs DPKG is earlier than 6.0.24-2ubuntu1.6 AND libservlet2.5-java-doc DPKG is earlier than 6.0.24-2ubuntu1.6 AND tomcat6 DPKG is earlier than 6.0.24-2ubuntu1.6 AND tomcat6-admin DPKG is earlier than 6.0.24-2ubuntu1.6 AND tomcat6-common DPKG is earlier than 6.0.24-2ubuntu1.6 AND tomcat6-user DPKG is earlier than 6.0.24-2ubuntu1.6 AND tomcat6-examples DPKG is earlier than 6.0.24-2ubuntu1.6

Definition Id: oval:org.mitre.oval:def:13969

Oval ID:	oval:org.mitre.oval:def:13969
Title:	HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Authentication Bypass, Cross-Site Scripting (XSS), Unauthorized Access, Denial of Service (DoS)
Description:	Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-3718	Version:	11
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
platforms HP Release B.11.23 AND HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.34.01

Definition Id: oval:org.mitre.oval:def:14945

Oval ID:	oval:org.mitre.oval:def:14945
Title:	HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Authentication Bypass, Cross-Site Scripting (XSS), Unauthorized Access, Denial of Service (DoS)
Description:	Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2011-0013	Version:	11
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
platforms HP Release B.11.23 AND HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.34.01

Definition Id: oval:org.mitre.oval:def:19269

Oval ID:	oval:org.mitre.oval:def:19269
Title:	HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities
Description:	Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2011-0013	Version:	12
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
platforms HP Release B.11.23 AND HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.36.01

Definition Id: oval:org.mitre.oval:def:19379

Oval ID:	oval:org.mitre.oval:def:19379
Title:	HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities
Description:	Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-3718	Version:	11
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
platforms HP Release B.11.23 AND HP-UX B.11.31 AND hpuxws22TOMCAT.TOMCAT version is less than B.5.5.36.01

Definition Id: oval:org.mitre.oval:def:21956

Oval ID:	oval:org.mitre.oval:def:21956
Title:	RHSA-2011:0791: tomcat6 security and bug fix update (Moderate)
Description:	Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Family:	unix	Class:	patch
Reference(s):	RHSA-2011:0791-01 CVE-2010-3718 CVE-2010-4172 CVE-2011-0013	Version:	42
Platform(s):	Red Hat Enterprise Linux 6	Product(s):	tomcat6
Definition Synopsis:
The operating system installed on the system is Red Hat Enterprise Linux 6 Packages section tomcat6-jsp-2.1-api is earlier than 0:6.0.24-33.el6 AND tomcat6-webapps is earlier than 0:6.0.24-33.el6 AND tomcat6-lib is earlier than 0:6.0.24-33.el6 AND tomcat6-docs-webapp is earlier than 0:6.0.24-33.el6 AND tomcat6-javadoc is earlier than 0:6.0.24-33.el6 AND tomcat6-el-2.1-api is earlier than 0:6.0.24-33.el6 AND tomcat6-admin-webapps is earlier than 0:6.0.24-33.el6 AND tomcat6-servlet-2.5-api is earlier than 0:6.0.24-33.el6 AND tomcat6 is earlier than 0:6.0.24-33.el6

Definition Id: oval:org.mitre.oval:def:23523

Oval ID:	oval:org.mitre.oval:def:23523
Title:	ELSA-2011:0791: tomcat6 security and bug fix update (Moderate)
Description:	Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Family:	unix	Class:	patch
Reference(s):	ELSA-2011:0791-01 CVE-2010-3718 CVE-2010-4172 CVE-2011-0013	Version:	17
Platform(s):	Oracle Linux 6	Product(s):	tomcat6
Definition Synopsis:
Oracle Linux 6.x rpm test tomcat6-jsp-2.1-api is earlier than 0:6.0.24-33.el6 AND tomcat6-webapps is earlier than 0:6.0.24-33.el6 AND tomcat6-lib is earlier than 0:6.0.24-33.el6 AND tomcat6-docs-webapp is earlier than 0:6.0.24-33.el6 AND tomcat6-javadoc is earlier than 0:6.0.24-33.el6 AND tomcat6-el-2.1-api is earlier than 0:6.0.24-33.el6 AND tomcat6-admin-webapps is earlier than 0:6.0.24-33.el6 AND tomcat6-servlet-2.5-api is earlier than 0:6.0.24-33.el6 AND tomcat6 is earlier than 0:6.0.24-33.el6

Definition Id: oval:org.mitre.oval:def:28146

Oval ID:	oval:org.mitre.oval:def:28146
Title:	DEPRECATED: ELSA-2011-0791 -- tomcat6 security and bug fix update (moderate)
Description:	[6.0.24-33] - resolves: rhbz 695284 - multiple instances logging fiasco [6.0.24-32] - Resolves: rhbz 698624 - inet4address can't be cast to String [6.0.24-31] - Resolves: rhbz 656403 - cve-2010-4172 jsp syntax error [6.0.24-30] - Resolves: rhbz#697504 initscript logging location [6.0.24-29] - Resolves: rhbz#656403, rhbz#675926, rhbz#676011 - CVE-2010-4172, CVE-2010-3718, CVE-2011-0013, CVE-2010-4476, - CVE-2011-0534 [6.0.24-28] - Resovles rhbz#695284 - wrapper logs to different locations - CVE-2010-4172, CVE-2011-0013, CVE-2010-3718 commented out - until needed. [6.0.24-27] - naming-factory-dbcp missing fix in tomcat6.conf - Add Obsoletes for log4j [6.0.24-26] - Add log4j to package lib. Corrected typo in log4 Provides - epock versus epoch [6.0.24-25] - Installed permissions do not allow tomcat to start - incrementing NVR so yum won't get confused with the zstream
Family:	unix	Class:	patch
Reference(s):	ELSA-2011-0791 CVE-2010-3718 CVE-2010-4172 CVE-2011-0013	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	tomcat6
Definition Synopsis:
Oracle Linux 6.x Packages match section tomcat6 is earlier than 0:6.0.24-33.el6 AND tomcat6-admin-webapps is earlier than 0:6.0.24-33.el6 AND tomcat6-docs-webapp is earlier than 0:6.0.24-33.el6 AND tomcat6-el-2.1-api is earlier than 0:6.0.24-33.el6 AND tomcat6-javadoc is earlier than 0:6.0.24-33.el6 AND tomcat6-jsp-2.1-api is earlier than 0:6.0.24-33.el6 AND tomcat6-lib is earlier than 0:6.0.24-33.el6 AND tomcat6-servlet-2.5-api is earlier than 0:6.0.24-33.el6 AND tomcat6-webapps is earlier than 0:6.0.24-33.el6

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Tomcat cpe:2.3:a:apache:tomcat:7.0.5:::::::* cpe:2.3:a:apache:tomcat:7.0.4:::::::* cpe:2.3:a:apache:tomcat:7.0.3:::::::* cpe:2.3:a:apache:tomcat:7.0.2:::::::* cpe:2.3:a:apache:tomcat:7.0.1:::::::* cpe:2.3:a:apache:tomcat:7.0.0:::::::* cpe:2.3:a:apache:tomcat:7.0.0:beta:::::: cpe:2.3:a:apache:tomcat:6.0.9:::::::* cpe:2.3:a:apache:tomcat:6.0.8:::::::* cpe:2.3:a:apache:tomcat:6.0.7:::::::* cpe:2.3:a:apache:tomcat:6.0.6:::::::* cpe:2.3:a:apache:tomcat:6.0.5:::::::* cpe:2.3:a:apache:tomcat:6.0.4:::::::* cpe:2.3:a:apache:tomcat:6.0.3:::::::* cpe:2.3:a:apache:tomcat:6.0.29:::::::* cpe:2.3:a:apache:tomcat:6.0.28:::::::* cpe:2.3:a:apache:tomcat:6.0.27:::::::* cpe:2.3:a:apache:tomcat:6.0.26:::::::* cpe:2.3:a:apache:tomcat:6.0.24:::::::* cpe:2.3:a:apache:tomcat:6.0.20:::::::* cpe:2.3:a:apache:tomcat:6.0.2:::::::* cpe:2.3:a:apache:tomcat:6.0.19:::::::* cpe:2.3:a:apache:tomcat:6.0.18:::::::* cpe:2.3:a:apache:tomcat:6.0.17:::::::* cpe:2.3:a:apache:tomcat:6.0.16:::::::* cpe:2.3:a:apache:tomcat:6.0.15:::::::* cpe:2.3:a:apache:tomcat:6.0.14:::::::* cpe:2.3:a:apache:tomcat:6.0.13:::::::* cpe:2.3:a:apache:tomcat:6.0.12:::::::* cpe:2.3:a:apache:tomcat:6.0.11:::::::* cpe:2.3:a:apache:tomcat:6.0.10:::::::* cpe:2.3:a:apache:tomcat:6.0.1:::::::* cpe:2.3:a:apache:tomcat:6.0.0:::::::* cpe:2.3:a:apache:tomcat:6.0:::::::* cpe:2.3:a:apache:tomcat:5.5.9:::::::* cpe:2.3:a:apache:tomcat:5.5.8:::::::* cpe:2.3:a:apache:tomcat:5.5.7:::::::* cpe:2.3:a:apache:tomcat:5.5.6:::::::* cpe:2.3:a:apache:tomcat:5.5.5:::::::* cpe:2.3:a:apache:tomcat:5.5.4:::::::* cpe:2.3:a:apache:tomcat:5.5.32:::::::* cpe:2.3:a:apache:tomcat:5.5.31:::::::* cpe:2.3:a:apache:tomcat:5.5.30:::::::* cpe:2.3:a:apache:tomcat:5.5.3:::::::* cpe:2.3:a:apache:tomcat:5.5.29:::::::* cpe:2.3:a:apache:tomcat:5.5.28:::::::* cpe:2.3:a:apache:tomcat:5.5.27:::::::* cpe:2.3:a:apache:tomcat:5.5.26:::::::* cpe:2.3:a:apache:tomcat:5.5.25:::::::* cpe:2.3:a:apache:tomcat:5.5.24:::::::* cpe:2.3:a:apache:tomcat:5.5.23:::::::* cpe:2.3:a:apache:tomcat:5.5.22:::::::* cpe:2.3:a:apache:tomcat:5.5.21:::::::* cpe:2.3:a:apache:tomcat:5.5.20:::::::* cpe:2.3:a:apache:tomcat:5.5.2:::::::* cpe:2.3:a:apache:tomcat:5.5.19:::::::* cpe:2.3:a:apache:tomcat:5.5.18:::::::* cpe:2.3:a:apache:tomcat:5.5.17:::::::* cpe:2.3:a:apache:tomcat:5.5.16:::::::* cpe:2.3:a:apache:tomcat:5.5.15:::::::* cpe:2.3:a:apache:tomcat:5.5.14:::::::* cpe:2.3:a:apache:tomcat:5.5.13:::::::* cpe:2.3:a:apache:tomcat:5.5.12:::::::* cpe:2.3:a:apache:tomcat:5.5.11:::::::* cpe:2.3:a:apache:tomcat:5.5.10:::::::* cpe:2.3:a:apache:tomcat:5.5.1:::::::* cpe:2.3:a:apache:tomcat:5.5.0:::::::*	67

OpenVAS Exploits

Date	Description
2012-08-10	Name : Gentoo Security Advisory GLSA 201206-24 (apache tomcat) File : nvt/glsa_201206_24.nasl
2012-07-30	Name : CentOS Update for tomcat5 CESA-2011:1845 centos5 x86_64 File : nvt/gb_CESA-2011_1845_tomcat5_centos5_x86_64.nasl
2012-06-06	Name : RedHat Update for tomcat6 RHSA-2011:0791-01 File : nvt/gb_RHSA-2011_0791-01_tomcat6.nasl
2011-12-23	Name : CentOS Update for tomcat5 CESA-2011:1845 centos5 i386 File : nvt/gb_CESA-2011_1845_tomcat5_centos5_i386.nasl
2011-12-23	Name : RedHat Update for tomcat5 RHSA-2011:1845-01 File : nvt/gb_RHSA-2011_1845-01_tomcat5.nasl
2011-10-21	Name : Fedora Update for tomcat6 FEDORA-2011-13457 File : nvt/gb_fedora_2011_13457_tomcat6_fc14.nasl
2011-10-20	Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2011-006) File : nvt/gb_macosx_su11-006.nasl
2011-05-05	Name : HP-UX Update for Apache Web Server HPSBUX02645 File : nvt/gb_hp_ux_HPSBUX02645.nasl
2011-04-01	Name : Ubuntu Update for tomcat6 vulnerabilities USN-1097-1 File : nvt/gb_ubuntu_USN_1097_1.nasl
2011-03-07	Name : Debian Security Advisory DSA 2160-1 (tomcat6) File : nvt/deb_2160_1.nasl
2011-03-05	Name : FreeBSD Ports: tomcat55 File : nvt/freebsd_tomcat55.nasl
2011-02-22	Name : Mandriva Update for tomcat5 MDVSA-2011:030 (tomcat5) File : nvt/gb_mandriva_MDVSA_2011_030.nasl
2011-01-31	Name : Ubuntu Update for tomcat6 vulnerability USN-1048-1 File : nvt/gb_ubuntu_USN_1048_1.nasl
2011-01-14	Name : Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabil... File : nvt/gb_apache_tomcat_45015.nasl
2011-01-14	Name : ISC BIND 9 < 9.7.2-P2 Multiple Vulnerabilities File : nvt/gb_bind_9_7_2_P2.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
71558	Apache Tomcat SecurityManager ServletContext Attribute Traversal Arbitrary Fi... Apache Tomcat contains a flaw that allows a local attacker to traverse outside of a restricted path. The issue is due to the 'SecurityManager' not properly making the 'ServletContext' attribute read-only, allowing for directory traversal style attacks (e.g., ../../). This directory traversal attack would allow the attacker to manipulate arbitrary files.
71557	Apache Tomcat HTML Manager Multiple XSS The HTML Manager Interface in Apache Tomcat contains multiple flaws that allow a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input related to the display-name tag before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
69456	Apache Tomcat Manager manager/html/sessions Multiple Parameter XSS Apache Tomcat Manager contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'sort' and 'orderBy' parameters upon submission to the manager/html/sessions script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_tomcat6-110211.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_tomcat6-110118.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1845.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110519_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111220_tomcat5_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-06-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-24.nasl - Type : ACT_GATHER_INFO
2011-12-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1845.nasl - Type : ACT_GATHER_INFO
2011-12-21	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1845.nasl - Type : ACT_GATHER_INFO
2011-10-21	Name : The remote Fedora host is missing a security update. File : fedora_2011-13457.nasl - Type : ACT_GATHER_INFO
2011-10-13	Name : The remote host is missing a Mac OS X update that fixes several security issues. File : macosx_SecUpd2011-006.nasl - Type : ACT_GATHER_INFO
2011-05-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0791.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_tomcat6-110118.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_tomcat6-110211.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_tomcat6-110202.nasl - Type : ACT_GATHER_INFO
2011-03-30	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1097-1.nasl - Type : ACT_GATHER_INFO
2011-03-18	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12687.nasl - Type : ACT_GATHER_INFO
2011-03-03	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_tomcat5-7337.nasl - Type : ACT_GATHER_INFO
2011-02-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-030.nasl - Type : ACT_GATHER_INFO
2011-02-16	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_553ec4ed38d611e094b1000c29ba66d2.nasl - Type : ACT_GATHER_INFO
2011-02-14	Name : The remote web server is affected by multiple vulnerabilities. File : tomcat_6_0_30.nasl - Type : ACT_GATHER_INFO
2011-02-14	Name : The remote web server is affected by a cross-site scripting vulnerability. File : tomcat_7_0_6.nasl - Type : ACT_GATHER_INFO
2011-02-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2160.nasl - Type : ACT_GATHER_INFO
2011-02-11	Name : The remote web server is affected by a cross-site scripting vulnerability. File : tomcat_5_5_32.nasl - Type : ACT_GATHER_INFO
2011-02-11	Name : The remote web server is affected by a security bypass vulnerability. File : tomcat_7_0_4.nasl - Type : ACT_GATHER_INFO
2011-01-25	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1048-1.nasl - Type : ACT_GATHER_INFO
2011-01-14	Name : The remote web server is affected by multiple cross-site scripting vulnerabil... File : tomcat_7_0_5.nasl - Type : ACT_GATHER_INFO
2010-07-16	Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_transfer_encoding.nasl - Type : ACT_ATTACK

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:54:44	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	10
CPE ID(s)	67
osvdb(s)	3
Openvas Exploit(s)	15
Nessus® Exploit(s)	27

	Related
4.3	CVE-2011-0013
4.3	CVE-2010-4172
1.2	CVE-2010-3718
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)