CVE-2008-2370 - Secunia

Blog

Careers

Secunia SmallBusiness

Products

Solutions

Customers

Partner

Resources

Company

Careers

Community

CVE Reference: CVE-2008-2370
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2008-2370

Description: Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/44156 SUSE http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html ST 1020623 SREASON http://securityreason.com/securityalert/4099 SAID Secunia Advisory: SA32266 Secunia Advisory: SA32120 Secunia Advisory: SA33797 Secunia Advisory: SA31865 Secunia Advisory: SA32222 Secunia Advisory: SA31982 Secunia Advisory: SA31891 Secunia Advisory: SA31639 Secunia Advisory: SA31379 Secunia Advisory: SA31381 Secunia Advisory: SA35393 Secunia Advisory: SA36249 Secunia Advisory: SA37460 Secunia Advisory: SA33999 Secunia Advisory: SA34013 REDHAT http://www.redhat.com/support/errata/RHSA-2008-0648.html http://www.redhat.com/support/errata/RHSA-2008-0862.html http://www.redhat.com/support/errata/RHSA-2008-0864.html OVAL http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10577 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5876 MLIST http://mail-archives.apache.org/mod_mbox/ode-user/200908.mbox/%3Cfbdc6a970908072141w20a7a9d9ka1f896ad8073dffb@mail.gmail.com%3E http://marc.info/?l=apache-announce&m=124972618803216&w=2 MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 HP http://marc.info/?l=bugtraq&m=123376588623823&w=2 FEDORA CONFIRM http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html http://www.vmware.com/security/advisories/VMSA-2009-0002.html http://tomcat.apache.org/security-4.html http://tomcat.apache.org/security-5.html http://support.apple.com/kb/HT3216 http://tomcat.apache.org/security-6.html BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/495022/100/0/threaded BID 30494 31681 APPLE http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Return to the previous page.

Products

Solutions

Customers

Partner

Resources

Company

Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)

Industry
Compliance
Technology
Integration

Customers
Testimonials

VARS
MSSP
Technology Partners
References

Factsheets
Reports
Webinars
Events

About us
Careers
Memberships
Newsroom

© 2002-2013 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability