Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » GLSA: tomcat

GLSA: tomcat

by Nikola Strahija on October 15th, 2002 A security vulnerability has been confirmed to exist in Apache Tomcat 4.0.x releases (including Tomcat 4.0.5), which allows to use a specially crafted URL to return the unprocessed source of a JSP page, or, under special circumstances, a static resource which would otherwise have been protected by security constraint, without the need for being properly authenticated.


This is based on a variant of the exploit that was
disclosed on 09/24/2002.

Read the full disclosure at
http://marc.theaimsgroup.com/?l=tomcat-dev&m=103417249325526&w=2

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-www/tomcat-4.0.5 and earlier update their systems
as follows:

emerge rsync
emerge tomcat
emerge clean

- - --------------------------------------------------------------------
[email protected] - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9q85zfT7nyhUpoZMRAripAKC2pwD2g82Np0cal/0afanM4mfVCgCfbx9o
dNLvNJOnmcq3QcvT/S4D3wQ=
=6MID
-----END PGP SIGNATURE-----


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »