SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Tomcat May Let Remote Users Access Restricted Contexts
SecurityTracker Alert ID:  1021039
SecurityTracker URL:  http://securitytracker.com/id/1021039
CVE Reference:   CVE-2008-3271   (Links to External Site)
Date:  Oct 10 2008
Impact:   Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.1.0 to 4.1.31, 5.5.0; earlier versions may also be affected
Description:   A vulnerability was reported in Tomcat. A remote user may be able to access a restricted context.

A remote user from a non-permitted IP address may be able to gain access to a context protected with a valve that extends the RemoteFilterValve setting.

Kenichi Tsukamoto of Fujitsu reported this vulnerability via JPCERT.

Impact:   A remote user may be able to access a restricted context.
Solution:   The vendor has issued a fixed version (4.1.32 or later, 5.5.1 or later, 6.0.0).
Vendor URL:  tomcat.apache.org/security.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Dec 8 2008 (Red Hat Issues Fix) Tomcat May Let Remote Users Access Restricted Contexts
Red Hat has released a fix for Red Hat Network Satellite Server.



 Source Message Contents

Subject:  [SECURITY] CVE-2008-3271 - Apache Tomcat information disclosure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2008-3271: Tomcat information disclosure vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.31
Tomcat 5.5.0
Tomcat 6.0.x is not affected
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected

Description:
Bug 25835 (https://issues.apache.org/bugzilla/show_bug.cgi?id=25835) can,
in very rare circumstances, permit a user from a non-permitted IP address
to gain access to a context protected with a valve that extends
RemoteFilterValve.

Mitigation:
Upgrade to:
4.1.32 or later
5.5.1 or later
6.0.0 or later

Example:
This has only been reproduced using a debugger to force a particular
processing sequence across two threads.

    1. Set a breakpoint right after the place where a value
       is to be entered in the instance variable of regexp
       (search:org.apache.regexp.CharacterIterator).

    2. Send a request from the IP address* which is not permitted.
       (stopped at the breakpoint)

       *About the IP address which is not permitted.
       The character strings length of the IP address which is set
       in RemoteAddrValve must be same.

    3. Send a request from the IP address which was set in
       RemoteAddrValve.
       (stopped at the breakpoint)
       In this way, the instance variable is to be overwritten here.

    4. Resume the thread which is processing the step 2 above.

    5. The request from the not permitted IP address will succeed.

Credit:
This issue was discovered by Kenichi Tsukamoto (Development Dept. II,
Application Management Middleware Div., FUJITSU LIMITED) and reported to
the Tomcat security team via JPCERT.

References:
http://tomcat.apache.org/security.html

Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkjuibsACgkQb7IeiTPGAkO33wCgiBY0nBdTaXBC8oPoHqMWH4mt
OtgAmQHjgnxg0vKKSp43vez8XaBIZpOj
=9Z/F
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC