Fix for CVE-2008-5515, CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, and CVE-2009-0783.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1164 advisory.

    - add patch for CVE-2007-5333       Resolves: rhbz#427779
    - add patch for CVE-2008-5515       Resolves: rhbz#504758
    - add patch for CVE-2009-0033
    - add patch for CVE-2009-0580       Resolves: rhbz#503980

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of WebSphere fixes the following vulnerabilities :

  - GERONIMO-3838: close potential denial of service attack

  - fix Apache Geronimo web administration console directory     traversal vulnerabilities. (CVE-2008-5518)

  - fix Apache Geronimo web administration console XSS     vulnerabilities. (CVE-2009-0038)

  - fix Apache Geronimo web administration console CSRF     vulnerabilities. (CVE-2009-0039)

  - Samples: Fix Apache Tomcat cross-site scripting     vulnerability. (CVE-2009-0781)

It was discovered that a prior security errata for Tomcat version tomcat5-5.5.23-0jpp.3.0.2.el5 did not address all possible flaws in the way Tomcat handles certain characters and character sequences in cookie values. A remote attacker could use this flaw to obtain sensitive information, such as session IDs, and then use this information for session hijacking attacks. (CVE-2007-5333)

Note: The fix for the CVE-2007-5333 flaw changes the default cookie processing behavior: with this update, version 0 cookies that contain values that must be quoted to be valid are automatically changed to version 1 cookies. To reactivate the previous, but insecure behavior, add the following entry to the '/etc/tomcat5/catalina.properties' file :

org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false

It was discovered that request dispatchers did not properly normalize user requests that have trailing query strings, allowing remote attackers to send specially crafted requests that would cause an information leak. (CVE-2008-5515)

A flaw was found in the way the Tomcat AJP (Apache JServ Protocol) connector processes AJP connections. An attacker could use this flaw to send specially crafted requests that would cause a temporary denial of service. (CVE-2009-0033)

It was discovered that the error checking methods of certain authentication classes did not have sufficient error checking, allowing remote attackers to enumerate (via brute-force methods) usernames registered with applications running on Tomcat when FORM-based authentication was used. (CVE-2009-0580)

A cross-site scripting (XSS) flaw was found in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the 'time' parameter.
(CVE-2009-0781)

It was discovered that web applications containing their own XML parsers could replace the XML parser Tomcat uses to parse configuration files. A malicious web application running on a Tomcat instance could read or, potentially, modify the configuration and XML-based data of other web applications deployed on the same Tomcat instance. (CVE-2009-0783)

This update of tomcat fixes several vulnerabilities :

  - CVE-2008-5515: RequestDispatcher usage can lead to     information leakage

  - CVE-2009-0033: denial of service via AJP connection

  - CVE-2009-0580: some authentication classes allow user     enumeration

  - CVE-2009-0781: XSS bug in example application cal2.jsp

  - CVE-2009-0783: replacing XML parser leads to information     leakage Additionally, non-security bugs were fixed.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1164 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer     Pages (JSP) technologies.

    It was discovered that the Red Hat Security Advisory RHSA-2007:0871 did not     address all possible flaws in the way Tomcat handles certain characters and     character sequences in cookie values. A remote attacker could use this flaw     to obtain sensitive information, such as session IDs, and then use this     information for session hijacking attacks. (CVE-2007-5333)

    Note: The fix for the CVE-2007-5333 flaw changes the default cookie     processing behavior: with this update, version 0 cookies that contain     values that must be quoted to be valid are automatically changed to version     1 cookies. To reactivate the previous, but insecure behavior, add the     following entry to the /etc/tomcat5/catalina.properties file:

    org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false

    It was discovered that request dispatchers did not properly normalize user     requests that have trailing query strings, allowing remote attackers to     send specially-crafted requests that would cause an information leak.
    (CVE-2008-5515)

    A flaw was found in the way the Tomcat AJP (Apache JServ Protocol)     connector processes AJP connections. An attacker could use this flaw to     send specially-crafted requests that would cause a temporary denial of     service. (CVE-2009-0033)

    It was discovered that the error checking methods of certain authentication     classes did not have sufficient error checking, allowing remote attackers     to enumerate (via brute force methods) usernames registered with     applications running on Tomcat when FORM-based authentication was used.
    (CVE-2009-0580)

    A cross-site scripting (XSS) flaw was found in the examples calendar     application. With some web browsers, remote attackers could use this flaw     to inject arbitrary web script or HTML via the time parameter.
    (CVE-2009-0781)

    It was discovered that web applications containing their own XML parsers     could replace the XML parser Tomcat uses to parse configuration files. A     malicious web application running on a Tomcat instance could read or,     potentially, modify the configuration and XML-based data of other web     applications deployed on the same Tomcat instance. (CVE-2009-0783)

    Users of Tomcat should upgrade to these updated packages, which contain     backported patches to resolve these issues. Tomcat must be restarted for     this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of tomcat fixes several vulnerabilities :

  - RequestDispatcher usage can lead to information leakage.
    (CVE-2008-5515)

  - denial of service via AJP connection. (CVE-2009-0033)

  - some authentication classes allow user enumeration.
    (CVE-2009-0580)

  - XSS bug in example application cal2.jsp. (CVE-2009-0781)

  - replacing XML parser leads to information leakage.
    (CVE-2009-0783)

Additionally, non-security bugs were fixed.

According to its self-reported version number, the Apache Tomcat server listening on the remote host is prior to 4.1.40, 5.5.28, or 6.0.20. It is, therefore, affected by the following vulnerabilities :

  - The remote server is affected by a directory traversal     vulnerability if a RequestDispatcher obtained from a     Request object is used. A specially crafted value for a     request parameter can be used to access potentially     sensitive configuration files or other files, e.g.,     files in the WEB-INF directory. (CVE-2008-5515)

  - The remote server is affected by a denial of service     vulnerability if configured to use the Java AJP     connector. An attacker can send a malicious request with     invalid headers which causes the AJP connector to be put     into an error state for a short time. This behavior can     be used as a denial of service attack. (CVE-2009-0033)

  - The remote server is affected by a username enumeration     vulnerability if configured to use FORM authentication     along with the 'MemoryRealm', 'DataSourceRealm', or     'JDBCRealm' authentication realms. (CVE-2009-0580)

  - The remote server is affected by a script injection     vulnerability if the example JSP application,     'cal2.jsp', is installed. An unauthenticated, remote     attacker can exploit this issue to inject arbitrary HTML     or script code into a user's browser to be executed     within the security context of the affected site.
    (CVE-2009-0781)

  - The remote server is vulnerable to unauthorized     modification of 'web.xml', 'context.xml', or TLD files     of arbitrary web applications. This vulnerability allows     the XML parser, used to process the XML and TLD files,     to be replaced. (CVE-2009-0783)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various vulnerabilities have been discovered in the Tomcat Servlet and JSP engine, resulting in denial of service, cross-site scripting, information disclosure and WAR file traversal. Further details on the individual security issues can be found on the Apache Tomcat 5 vulnerabilities page.

The remote web server includes an example JSP application, 'cal2.jsp' that fails to sanitize user-supplied input before using it to generate dynamic content.  An unauthenticated remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.  

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote web server includes an example JSP application, 'cal2.jsp' that fails to sanitize user-supplied input before using it to generate dynamic content.  An unauthenticated remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42901	Fedora 12 : tomcat6-6.0.20-1.fc12 (2009-11352)	Nessus	Fedora Local Security Checks	2009/11/30	2021/1/11	medium
42902	Fedora 10 : tomcat6-6.0.20-1.fc10 (2009-11356)	Nessus	Fedora Local Security Checks	2009/11/30	2021/1/11	medium
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
67895	Oracle Linux 5 : tomcat (ELSA-2009-1164)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
41458	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
60621	Scientific Linux Security Update : tomcat on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
40144	openSUSE Security Update : tomcat6 (tomcat6-999)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
40316	openSUSE Security Update : tomcat6 (tomcat6-999)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
40342	RHEL 5 : tomcat (RHSA-2009:1164)	Nessus	Red Hat Local Security Checks	2009/7/22	2024/11/4	medium
41314	SuSE9 Security Update : Tomcat (YOU Patch Number 12460)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
46753	Apache Tomcat < 4.1.40 / 5.5.28 / 6.0.20 Multiple Vulnerabilities	Nessus	Web Servers	2010/5/28	2024/5/6	medium
53212	Debian DSA-2207-1 : tomcat5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	2011/3/30	2021/1/4	medium
4501	Apache Tomcat Sample App cal2.jsp time Parameter XSS (CVE-2009-0781)	Nessus Network Monitor	Web Servers	2004/8/18	2019/3/6	medium
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2010/3/30	2019/3/6	critical
800603	Apache Tomcat Sample App cal2.jsp time Parameter XSS (CVE-2009-0781)	Log Correlation Engine	Web Servers			medium

检测

插件搜索

medium

medium

critical

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium