Apache Tomcat does not properly verify input allowing users to retrieve directory listings.

The problem is that Apache Tomcat doesn't parse binary nullcharacters and backslashs correctly, by requesting GET /\x00.jps it is possible to force directory listing even if index files are present.

It is also possible to make Apache Tomcat return the contents of jsp files and to interpret html files as java files. This will reveal the contents of the .jsp file:
GET /examples/jsp/cal/cal1.jsp\x00.html

Only Apache Tomcat prior to 3.3.1a with JDK 1.3.1 or earlier is vulnerable according to the vendor.

Solution
Version 3.3.1a is not vulnerable:
Further details available in Customer Area

Provided and/or discovered by
Jouko Pynnönen

Deep Links
Links available in Customer Area