[27432] in bugtraq
GLSA: tomcat
daemon@ATHENA.MIT.EDU (Daniel Ahlberg)
Tue Oct 15 14:30:30 2002
From: Daniel Ahlberg <aliz@gentoo.org>
Date: Tue, 15 Oct 2002 10:14:43 +0200
To: bugtraq@securityfocus.com
Message-Id: <20021015081019.0D1B03373A@mail1.tamperd.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200210-001
- - --------------------------------------------------------------------
PACKAGE : tomcat
SUMMARY : source disclosure
EXPLOIT : remote
DATE : 2002-10-15 08:15 UTC
- - --------------------------------------------------------------------
A security vulnerability has been confirmed to exist in Apache Tomcat
4.0.x releases (including Tomcat 4.0.5), which allows to use a specially
crafted URL to return the unprocessed source of a JSP page, or, under
special circumstances, a static resource which would otherwise have been
protected by security constraint, without the need for being properly
authenticated. This is based on a variant of the exploit that was
disclosed on 09/24/2002.
Read the full disclosure at
http://marc.theaimsgroup.com/?l=tomcat-dev&m=103417249325526&w=2
SOLUTION
It is recommended that all Gentoo Linux users who are running
net-www/tomcat-4.0.5 and earlier update their systems
as follows:
emerge rsync
emerge tomcat
emerge clean
- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE9q85zfT7nyhUpoZMRAripAKC2pwD2g82Np0cal/0afanM4mfVCgCfbx9o
dNLvNJOnmcq3QcvT/S4D3wQ=
=6MID
-----END PGP SIGNATURE-----
