Advisories MDVSA-2010:177: tomcat5

[paul]

Multiple vulnerabilities has been found and corrected in tomcat5:

 

Directory traversal vulnerability in Apache Tomcat 5.5.0 through

5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or

overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file,

as demonstrated by a ../../bin/catalina.bat entry (CVE-2009-2693).

 

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and

6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase

files that remain from a failed undeploy, which might allow remote

attackers to bypass intended authentication requirements via HTTP

requests (CVE-2009-2901).

 

Directory traversal vulnerability in Apache Tomcat 5.5.0 through

5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete

work-directory files via directory traversal sequences in a WAR

filename, as demonstrated by the ...war filename (CVE-2009-2902).

 

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might

allow remote attackers to discover the server's hostname or IP

address by sending a request for a resource that requires (1) BASIC or

(2) DIGEST authentication, and then reading the realm field in the

WWW-Authenticate header in the reply (CVE-2010-1157).

 

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0

beta does not properly handle an invalid Transfer-Encoding header,

which allows remote attackers to cause a denial of service (application

outage) or obtain sensitive information via a crafted header that

interferes with recycling of a buffer. (CVE-2010-2227)

 

Packages for 2009.0 are provided as of the Extended Maintenance

Program. Please visit this link to learn more:

http://store.mandriva.com/product_info.php?cPath=149&products_id=490

 

The updated packages have been patched to correct these issues.