PT-2014-1447 · Apache+5 · Apache Tomcat+5

Published 2014-05-21 · Updated 2022-05-14 · CVE-2014-0119

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.39 Apache Tomcat versions 7.0.0 through 7.0.53 Apache Tomcat versions 8.0.0 through 8.0.5

Description The issue allows remote attackers to read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. It also allows reading files associated with different web applications on a single Tomcat instance via a crafted web application. This is due to the improper constraint of the class loader that accesses the XML parser used with an XSLT stylesheet.

Recommendations For Apache Tomcat versions 6.0.0 through 6.0.39, update to version 6.0.40 or later. For Apache Tomcat versions 7.0.0 through 7.0.53, update to version 7.0.54 or later. For Apache Tomcat versions 8.0.0 through 8.0.5, update to version 8.0.6 or later. As a temporary workaround, consider restricting access to the XML parser used by the default servlet, JSP documents, tag library descriptors (TLDs), and tag plugin configuration files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-112

CWE-264

Related Identifiers

BDU:2015-00409

CESA-2014_1034

CESA-2014_1038

CVE-2014-0119

DSA-3530-1

DSA-3552-1

GHSA-PRC3-7F44-W48J

HPSBUX03102

MGASA-2014-0268

RHSA-2014:0843

RHSA-2014:1034

RHSA-2014:1038

RHSA-2014:1087

RHSA-2014:1088

RHSA-2014_1034

RHSA-2014_1038

USN-2654-1

Affected Products

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

Ubuntu

References · 100

• http://rhn.redhat.com/errata/RHSA-2015-0765.html · Vendor Advisory
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0227 · Vendor Advisory
• http://debian.org/security/2016/dsa-3552 · Vendor Advisory
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:052 · Vendor Advisory
• http://tomcat.apache.org/security-8.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0119 · Security Note
• http://debian.org/security/2016/dsa-3530 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-1034.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0119 · Vendor Advisory
• http://ubuntu.com/usn/USN-2654-1 · Vendor Advisory