|
--------------------------------------------------------------------------------------------------- ScanAlert Security Advisory http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x (5.0.28, 5.5.12, 5.5.9, and 5.5.7 –
Confirmed) Credit: ScanAlert’s Enterprise Services Team. Risk Common Vulnerability Scoring System (CVSS) - http://www.first.org/cvss/intro/ Related Attack Complexity: Low Level Of Authentication Needed: Not Required Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None Overview Apache Tomcat is the servlet container that is used in the
official Reference Implementation for the Java Servlet and JavaServer Pages
technologies. Vulnerabilities Apache Tomcat can be forced to reveal a complete directory
listing for any directory by requesting a mapped file extension prepended with
a semicolon, a reserved character. The file does not need to exist. Examples http://www.sitexyz.com/;index.jsp http://www.sitexyz.com/help/;help.do Solution Upgrade to the latest stable Tomcat release. Confirmed fix
is available in Apache Tomcat v5.5.17 About ScanAlert ScanAlert's mission is to make the web safe
from hackers. We make web sites secure from hackers and certify it to
their customers via our patent pending HACKER SAFE® security certification
technology. Our daily security audits and real-time certification enables
consumers to know whether the sites where they shop are taking the necessary
steps to safeguard their personal information from hackers. By alleviating
consumers' fears of identity theft and credit card fraud, online merchants who
earn HACKER SAFE certification consistently see substantial increases in online
transactions Joseph Pierini, CISSP | Director, Phone: 877 302-9965 Int'l: 707 224-7656 Fax: 707 252-9626 Email: joep (at) scanalert.com |
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
