PT-2006-4694 · Apache · Apache Tomcat

Published 2006-07-25 · Updated 2022-05-01 · CVE-2006-3835

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 5.5.17

Description The issue allows remote attackers to list directories by inserting a semicolon (;) before a filename with a mapped extension. This is possible because the semicolon is used as a separator for path parameters, which changes the request into a directory request with a path parameter. If directory listings are enabled, a directory listing will be shown. This behavior was considered a security concern and led to changes in the default settings.

Recommendations For Apache Tomcat versions prior to 5.5.17, consider disabling directory listings to minimize the risk of exploitation. As a permanent fix, update to version 5.5.17 or later, where directory listings are disabled by default.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-3835

GHSA-WFJ7-MHR5-PCWQ

RHSA-2007:0326

RHSA-2007:0340

RHSA-2007:1069

RHSA-2008:0261

RHSA-2008:0524

RHSA-2010:0602

Affected Products

Apache Tomcat

References · 46

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0467.html · Exploit
• 🔥 https://exploit-db.com/exploits/28254 · Exploit
• 🔥 http://securityfocus.com/bid/19106 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3835 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfj7-mhr5-pcwq · Vendor Advisory
• https://github.com/apache/tomcat · Note
• http://tomcat.apache.org/security-4.html · Note
• http://securenetwork.it/ricerca/advisory/download/SN-2009-02.txt · Note
• http://securityfocus.com/archive/1/468048/100/0/threaded · Note
• http://vupen.com/english/advisories/2008/1979/references · Note
• http://secunia.com/advisories/25212 · Note
• https://tomcat.apache.org/security-5 · Note