PT-2007-4657 · Apache+2 · Apache Tomcat+2

Published 2007-08-14 · Updated 2022-05-01 · CVE-2007-3382

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 3.3 to 3.3.2 Apache Tomcat versions 4.1.0 to 4.1.36 Apache Tomcat versions 5.0.0 to 5.0.30 Apache Tomcat versions 5.5.0 to 5.5.24 Apache Tomcat versions 6.0.0 to 6.0.13

Description The issue arises from Apache Tomcat treating single quotes (') as delimiters in cookies. This might cause sensitive information, such as session IDs, to be leaked, allowing remote attackers to conduct session hijacking attacks. In certain circumstances, this leads to the leaking of information like session IDs to attackers.

Recommendations For Apache Tomcat versions 3.3 to 3.3.2, update to a version that does not treat single quotes as delimiters in cookies. For Apache Tomcat versions 4.1.0 to 4.1.36, update to a version that does not treat single quotes as delimiters in cookies. For Apache Tomcat versions 5.0.0 to 5.0.30, update to a version that does not treat single quotes as delimiters in cookies. For Apache Tomcat versions 5.5.0 to 5.5.24, update to a version that does not treat single quotes as delimiters in cookies. For Apache Tomcat versions 6.0.0 to 6.0.13, update to a version that does not treat single quotes as delimiters in cookies. As a temporary workaround, consider restricting access to sensitive cookies to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-3382

DSA-1447-1

DSA-1453-1

GHSA-QFF8-G48J-PWPW

HPSBUX02262

RHSA-2007:0871

RHSA-2007:0876

RHSA-2007:0950

RHSA-2007:1069

RHSA-2007_0871

RHSA-2008:0195

RHSA-2008:0261

RHSA-2008:0524

RHSA-2010:0602

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 83

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_modjk_overflow.rb · Exploit
• 🔥 https://exploit-db.com/exploits/30496 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3385 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:241 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0950.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0450 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1860 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55562 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2450 · Security Note