Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Sun Alert 251986 Security Vulnerabilities in Tomcat 5.5 may Lead to Cross Site Scripting (XSS) or Directory Traversal
Informations
Name SUN-251986 First vendor Publication 2009-02-25
Vendor Sun Last vendor Modification 2009-02-25
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Solaris 9 Operating System Solaris 10 Operating System OpenSolaris

There are three security vulnerabilities in the Tomcat JSP/Servlet container that affect Tomcat 5.5 bundled in Solaris 9 and Solaris 10.

The first two security vulnerabilities are Cross Site Scripting (XSS) issues. One in the HttpServletResponse.sendError method (CVE-2008-1232) and the other in the Tomcat Virtual Host Manager (CVE-2008-1947). These may allow a local or remote unprivileged user to inject arbitrary web script or HTML, which in turn may allow the unprivileged user to bypass access control and gain access to unauthorized data.

The third security vulnerability is a Directory Traversal vulnerability in the RequestDispatcher class (CVE-2008-2370) that may allow a local or remote unprivileged user to bypass access control and gain access to unauthorized data.

Additional information regarding these issues is available at:
State: Resolved
First released: 25-Feb-2009

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_251986_security_vulnerabilities

CWE : Common Weakness Enumeration

% Id Name
67 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
33 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10577
 
Oval ID: oval:org.mitre.oval:def:10577
Title: Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Description: Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Family: unix Class: vulnerability
Reference(s): CVE-2008-2370
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11181
 
Oval ID: oval:org.mitre.oval:def:11181
Title: Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Description: Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1232
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11534
 
Oval ID: oval:org.mitre.oval:def:11534
Title: Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Description: Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1947
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19964
 
Oval ID: oval:org.mitre.oval:def:19964
Title: DSA-1593-1 tomcat5.5
Description: It was discovered that the Host Manager web application performed insufficient input sanitising, which could lead to cross-site scripting.
Family: unix Class: patch
Reference(s): DSA-1593-1
CVE-2008-1947
Version: 5
Platform(s): Debian GNU/Linux 4.0
Product(s): tomcat5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:5876
 
Oval ID: oval:org.mitre.oval:def:5876
Title: Security vulnerability in the RequestDispatcher class in Tomcat 5.5 bundled with Solaris 9 and Solaris 10 may lead to Directory Traversal.
Description: Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Family: unix Class: vulnerability
Reference(s): CVE-2008-2370
Version: 1
Platform(s): Sun Solaris 9
Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:5985
 
Oval ID: oval:org.mitre.oval:def:5985
Title: Security vulnerability in the HttpServletResponse.sendError method in Tomcat 5.5 bundled with Solaris 9 and Solaris 10 may lead to Cross Site Scripting (XSS).
Description: Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1232
Version: 1
Platform(s): Sun Solaris 9
Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6009
 
Oval ID: oval:org.mitre.oval:def:6009
Title: Security vulnerability in the Virtual Host Manager in Tomcat 5.5 bundled with Solaris 9 and Solaris 10 may lead to Cross Site Scripting (XSS).
Description: Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1947
Version: 1
Platform(s): Sun Solaris 9
Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8361
 
Oval ID: oval:org.mitre.oval:def:8361
Title: DSA-1593 tomcat5.5 -- missing input sanitising
Description: It was discovered that the Host Manager web application performed insufficient input sanitising, which could lead to cross-site scripting.
Family: unix Class: patch
Reference(s): DSA-1593
CVE-2008-1947
Version: 3
Platform(s): Debian GNU/Linux 4.0
Product(s): tomcat5.5
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 165

OpenVAS Exploits

Date Description
2010-05-12 Name : Mac OS X Security Update 2008-007
File : nvt/macosx_secupd_2008-007.nasl
2009-10-13 Name : SLES10: Security update for Websphere Community Edition
File : nvt/sles10_websphere-as_ce0.nasl
2009-06-05 Name : Ubuntu USN-719-1 (libpam-krb5)
File : nvt/ubuntu_719_1.nasl
2009-06-05 Name : Ubuntu USN-720-1 (php5)
File : nvt/ubuntu_720_1.nasl
2009-06-05 Name : Ubuntu USN-723-1 (git-core)
File : nvt/ubuntu_723_1.nasl
2009-05-05 Name : HP-UX Update for Apache Web Server Suite HPSBUX02401
File : nvt/gb_hp_ux_HPSBUX02401.nasl
2009-04-09 Name : Mandriva Update for tomcat5 MDVSA-2008:188 (tomcat5)
File : nvt/gb_mandriva_MDVSA_2008_188.nasl
2009-03-06 Name : RedHat Update for tomcat RHSA-2008:0648-01
File : nvt/gb_RHSA-2008_0648-01_tomcat.nasl
2009-02-18 Name : SuSE Security Summary SUSE-SR:2009:004
File : nvt/suse_sr_2009_004.nasl
2009-02-17 Name : Fedora Update for tomcat6 FEDORA-2008-7977
File : nvt/gb_fedora_2008_7977_tomcat6_fc9.nasl
2009-02-17 Name : Fedora Update for tomcat5 FEDORA-2008-8113
File : nvt/gb_fedora_2008_8113_tomcat5_fc9.nasl
2009-02-17 Name : Fedora Update for tomcat5 FEDORA-2008-8130
File : nvt/gb_fedora_2008_8130_tomcat5_fc8.nasl
2008-08-07 Name : Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
File : nvt/secpod_apache_tomcat_xss_n_bypass_vuln_900021.nasl
2008-06-11 Name : Debian Security Advisory DSA 1593-1 (tomcat5.5)
File : nvt/deb_1593_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
62511 CA Service Desk Tomcat host-manager/html/add name Parameter XSS

CA Service Desk Tomcat contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'name' parameter upon submission to the 'host-manager/html/add' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
47463 Apache Tomcat RequestDispatcher Traversal Arbitrary File Access

47462 Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS

45905 Apache Tomcat Host Manager host-manager/html/add name Parameter XSS

Nessus® Vulnerability Scanner

Date Description
2016-03-03 Name : The remote host is missing a security-related patch.
File : vmware_VMSA-2009-0016_remote.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL9110.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0648.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0877.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080827_tomcat_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2010-07-01 Name : The remote Apache Tomcat server is affected by multiple vulnerabilities.
File : tomcat_6_0_18.nasl - Type : ACT_GATHER_INFO
2010-06-11 Name : The remote web server is affected by multiple vulnerabilities.
File : tomcat_4_1_39.nasl - Type : ACT_GATHER_INFO
2010-01-10 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-1007.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0648.nasl - Type : ACT_GATHER_INFO
2009-11-23 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2009-0016.nasl - Type : ACT_GATHER_INFO
2009-10-19 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2009-0002.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_websphere-as_ce-5850.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_tomcat6-080702.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-188.nasl - Type : ACT_GATHER_INFO
2008-10-10 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO
2008-09-17 Name : The remote Fedora host is missing a security update.
File : fedora_2008-8130.nasl - Type : ACT_GATHER_INFO
2008-09-17 Name : The remote Fedora host is missing a security update.
File : fedora_2008-8113.nasl - Type : ACT_GATHER_INFO
2008-09-12 Name : The remote Fedora host is missing a security update.
File : fedora_2008-7977.nasl - Type : ACT_GATHER_INFO
2008-08-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0648.nasl - Type : ACT_GATHER_INFO
2008-07-08 Name : The remote openSUSE host is missing a security update.
File : suse_tomcat55-5385.nasl - Type : ACT_GATHER_INFO
2008-06-16 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1593.nasl - Type : ACT_GATHER_INFO