Description

Some weaknesses and a security issue have been reported in Apache Tomcat, which can be exploited by malicious users and malicious people to manipulate certain data, and by malicious people to gain access to potentially sensitive information.

An error within the autodeployment functionality may lead to deployed files with improper access restrictions and missing input validation when deploying WAR files can be exploited to e.g. delete files within the host's work directory or create arbitrary files outside of the web root.

For more information:
SA38316

The weaknesses and the security issue are reported in version 5.5.0 to 5.5.28.

Solution
Fixed in the SVN repository. Reportedly, this will be fixed in the upcoming version 5.5.29.
Further details available to Secunia VIM customers

Original Advisory
http://tomcat.apache.org/security-5.html
1) http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0476.html
2) http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0478.html
3) http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0477.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers