PT-2009-3394 · Apache+2 · Apache Tomcat+2

Published 2009-06-03 · Updated 2023-02-13 · CVE-2009-0783

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.0 through 4.1.39 Apache Tomcat versions 5.5.0 through 5.5.27 Apache Tomcat versions 6.0.0 through 6.0.18

Description The issue allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. This is possible because a web application can replace the XML parser used by Tomcat to process these files. In limited circumstances, a rogue web application may be able to view and/or alter the web.xml, context.xml, and tld files of other web applications deployed on the Tomcat instance.

Recommendations For Apache Tomcat versions 4.1.0 through 4.1.39, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 5.5.0 through 5.5.27, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 6.0.0 through 6.0.18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the XML parser used by Tomcat to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-0783

DSA-2207-1

GHSA-HHJG-G8XQ-HHR3

HPSBUX02579

HPSBUX02860

RHSA-2009:1143

RHSA-2009:1144

RHSA-2009:1145

RHSA-2009:1146

RHSA-2009:1164

RHSA-2009:1454

RHSA-2009:1506

RHSA-2009:1562

RHSA-2009:1563

RHSA-2009:1616

RHSA-2009:1617

RHSA-2009_1164

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 100

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• http://svn.apache.org/viewvc?rev=781708&view=rev · Patch
• http://secunia.com/advisories/42368 · Vendor Advisory
• http://tomcat.apache.org/security-4.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2207 · Vendor Advisory
• http://svn.apache.org/viewvc?rev=739522&view=rev · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0781 · Security Note
• http://marc.info/?l=bugtraq&m=136485229118404&w=2 · Vendor Advisory