PT-2005-5497 · Apache · Apache Tomcat

Published 2005-12-31 · Updated 2022-05-01 · CVE-2005-4836

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.15 through 4.1.40

Description The issue allows remote attackers to read JSP source files and obtain sensitive information by not rejecting NULL bytes in a URL when allowLinking is configured. This is specifically related to the deprecated HTTP/1.1 connector. The failure to reject the null byte enables an attacker to obtain the source for any JSP page in contexts configured with allowLinking=true.

Recommendations For Apache Tomcat versions 4.1.15 through 4.1.40, consider using the default, supported Coyote HTTP/1.1 connector, which does not exhibit this issue, as a workaround to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2005-4836

GHSA-QRCX-P4RR-G48H

Affected Products

Apache Tomcat

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-4836 · Security Note
• https://osv.dev/vulnerability/GHSA-qrcx-p4rr-g48h · Vendor Advisory
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Note
• http://securityfocus.com/bid/28483 · Note
• https://tomcat.apache.org/security-4 · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4836 · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E · Note
• http://tomcat.apache.org/security-4.html · Note