This update of tomcat fixes several vulnerabilities :

  - RequestDispatcher usage can lead to information leakage.
    (CVE-2008-5515)

  - denial of service via AJP connection. (CVE-2009-0033)

  - some authentication classes allow user enumeration.
    (CVE-2009-0580)

  - XSS bug in example application cal2.jsp. (CVE-2009-0781)

  - replacing XML parser leads to information leakage.
    (CVE-2009-0783)

Additionally, non-security bugs were fixed.

Fix for CVE-2008-5515, CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, and CVE-2009-0783.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security vulnerabilities has been identified and fixed in tomcat5 :

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request (CVE-2008-5515).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header (CVE-2009-0033).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter (CVE-2009-0580).

The calendar application in the examples web application contains an XSS flaw due to invalid HTML which renders the XSS filtering protection ineffective (CVE-2009-0781).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application (CVE-2009-0783).

The updated packages have been patched to prevent this. Additionally Apache Tomcat has been upgraded to the latest 5.5.27 version for 2009.0.

This update of tomcat fixes several vulnerabilities :

  - RequestDispatcher usage can lead to information leakage.
    (CVE-2008-5515)

  - denial of service via AJP connection. (CVE-2009-0033)

  - some authentication classes allow user enumeration.
    (CVE-2009-0580)

  - XSS bug in example application cal2.jsp. (CVE-2009-0781)

  - replacing XML parser leads to information leakage     Additionally, non-security bugs were fixed.
    (CVE-2009-0783)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Apache Geronimo
  - Apache Tomcat
  - Apache Xerces2
  - cURL/libcURL
  - ISC BIND
  - Libxml2
  - Linux kernel
  - Linux kernel 64-bit
  - Linux kernel Common Internet File System
  - Linux kernel eCryptfs
  - NTP
  - Python
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Abstract Window Toolkit (AWT)
  - Java SE Plugin
  - Java SE Provider
  - Java SE Swing
  - Java SE Web Start

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
41314	SuSE9 Security Update : Tomcat (YOU Patch Number 12460)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
42901	Fedora 12 : tomcat6-6.0.20-1.fc12 (2009-11352)	Nessus	Fedora Local Security Checks	2009/11/30	2021/1/11	medium
39486	Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:138)	Nessus	Mandriva Local Security Checks	2009/6/23	2021/1/6	medium
41592	SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 6352)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical

检测

插件搜索

medium

medium

medium

medium

critical