PT-2010-1276 · Apache · Apache Tomcat

Published 2010-01-21 · Updated 2023-02-13 · CVE-2009-2901

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.0 through 5.5.28 Apache Tomcat versions 6.0.0 through 6.0.20

Description The autodeployment process in Apache Tomcat, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy. This might allow remote attackers to bypass intended authentication requirements via HTTP requests. By default, Tomcat automatically deploys any directories placed in a host's appBase, and after a failed undeploy, the remaining files will be deployed as a result of the autodeployment process. Depending on circumstances, files normally protected by one or more security constraints may be deployed without those security constraints, making them accessible without authentication. This issue only affects Windows platforms.

Recommendations For Apache Tomcat versions 5.5.0 through 5.5.28, consider disabling the autoDeploy feature to prevent the deployment of remaining files after a failed undeploy. For Apache Tomcat versions 6.0.0 through 6.0.20, consider disabling the autoDeploy feature to prevent the deployment of remaining files after a failed undeploy. As a temporary workaround, consider restricting access to the appBase directory to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-264

Related Identifiers

CVE-2009-2901

GHSA-HJFH-7C4V-7Q8H

Affected Products

Apache Tomcat

References · 47

• http://tomcat.apache.org/security-6.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html · Vendor Advisory
• http://ubuntu.com/usn/usn-899-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:176 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133469267822771&w=2 · Vendor Advisory
• http://svn.apache.org/viewvc?rev=902650&view=rev · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2901 · Security Note
• https://osv.dev/vulnerability/GHSA-hjfh-7c4v-7q8h · Vendor Advisory
• http://tomcat.apache.org/security-5.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html · Vendor Advisory
• http://svn.apache.org/viewvc?rev=892815&view=rev · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2010:177 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=139344343412337&w=2 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0213 · Vendor Advisory