PT-2005-5497 · Apache · Apache Tomcat

Publicado 2005-12-31 · Atualizado 2022-05-01 · CVE-2005-4836

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.15 through 4.1.40

Description The issue allows remote attackers to read JSP source files and obtain sensitive information by not rejecting NULL bytes in a URL when allowLinking is configured. This is specifically related to the deprecated HTTP/1.1 connector. The failure to reject the null byte enables an attacker to obtain the source for any JSP page in contexts configured with allowLinking=true.

Recommendations For Apache Tomcat versions 4.1.15 through 4.1.40, consider using the default, supported Coyote HTTP/1.1 connector, which does not exhibit this issue, as a workaround to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2005-4836

GHSA-QRCX-P4RR-G48H

Produtos afetados

Apache Tomcat

Referências · 12

• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4836 · Nota de Segurança
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Nota
• http://securityfocus.com/bid/28483 · Nota
• https://tomcat.apache.org/security-4 · Nota
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-qrcx-p4rr-g48h · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4836 · Nota
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E · Nota
• http://tomcat.apache.org/security-4.html · Nota