PT-2009-3392 · Apache+2 · Apache Tomcat+2

Publicado 2009-03-09 · Atualizado 2023-02-13 · CVE-2009-0781

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.0 through 4.1.39 Apache Tomcat versions 5.5.0 through 5.5.27 Apache Tomcat versions 6.0.0 through 6.0.18

Description The issue is related to a cross-site scripting (XSS) flaw in the calendar application, specifically in the jsp/cal/cal2.jsp file. This flaw is caused by invalid HTML, which makes the XSS filtering protection ineffective. Remote attackers can inject arbitrary web script or HTML via the time parameter.

Recommendations For Apache Tomcat versions 4.1.0 through 4.1.39, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 5.5.0 through 5.5.27, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 6.0.0 through 6.0.18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the calendar application in the examples web application until a patch is available. Avoid using the time parameter in the affected jsp/cal/cal2.jsp file until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-0781

DSA-2207-1

GHSA-J788-FX57-99WP

HPSBUX02579

HPSBUX02860

RHSA-2009:1164

RHSA-2009:1562

RHSA-2009_1164

Produtos afetados

Apache Tomcat

Hp-Ux

Red Hat

Referências · 101

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• http://marc.info/?l=bugtraq&m=133469267822771&w=2 · Aviso do Fabricante
• http://secunia.com/advisories/42368 · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Nota
• https://tomcat.apache.org/security-4.html · Nota
• http://debian.org/security/2011/dsa-2207 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0781 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2008-5515 · Nota