CVE-2007-5342 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-5342
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-5342

Description: The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/39201 SUSE http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html SREASON http://securityreason.com/securityalert/3485 SAID Secunia Advisory: SA28274 Secunia Advisory: SA28317 Secunia Advisory: SA28915 Secunia Advisory: SA29313 Secunia Advisory: SA29711 Secunia Advisory: SA30676 Secunia Advisory: SA32222 Secunia Advisory: SA32120 Secunia Advisory: SA32266 REDHAT http://www.redhat.com/support/errata/RHSA-2008-0834.html http://www.redhat.com/support/errata/RHSA-2008-0833.html http://www.redhat.com/support/errata/RHSA-2008-0832.html http://www.redhat.com/support/errata/RHSA-2008-0831.html http://www.redhat.com/support/errata/RHSA-2008-0862.html http://www.redhat.com/support/errata/RHSA-2008-0042.html http://www.redhat.com/support/errata/RHSA-2008-0195.html OSVDB 39833 MISC http://svn.apache.org/viewvc?view=rev&revision=606594 MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 GENTOO http://security.gentoo.org/glsa/glsa-200804-10.xml FEDORA DEBIAN http://www.debian.org/security/2008/dsa-1447 CONFIRM http://support.apple.com/kb/HT3216 http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm http://tomcat.apache.org/security-6.html http://www.vmware.com/security/advisories/VMSA-2008-0010.html http://tomcat.apache.org/security-5.html BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/485481/100/0/threaded BID 27006 31681 APPLE http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Return to the previous page.