CVE-2008-2938 - Secunia

Blog

Careers

Secunia SmallBusiness

Products

Solutions

Customers

Partner

Resources

Company

Careers

Community

CVE Reference: CVE-2008-2938
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2008-2938

Description: Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/44411 SUSE http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html ST 1020665 SREASON http://securityreason.com/securityalert/4148 SAID Secunia Advisory: SA32266 Secunia Advisory: SA31639 Secunia Advisory: SA31891 Secunia Advisory: SA31865 Secunia Advisory: SA32120 Secunia Advisory: SA33797 Secunia Advisory: SA32222 Secunia Advisory: SA31982 Secunia Advisory: SA37297 REDHAT http://www.redhat.com/support/errata/RHSA-2008-0864.html http://www.redhat.com/support/errata/RHSA-2008-0862.html http://www.redhat.com/support/errata/RHSA-2008-0648.html OVAL http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10587 MISC http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt MILW0RM http://www.milw0rm.com/exploits/6229 MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 HP http://marc.info/?l=bugtraq&m=123376588623823&w=2 FEDORA CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm http://support.apple.com/kb/HT3216 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-4.html http://tomcat.apache.org/security-5.html CERT-VN 343355 BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/507729/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/495318/100/0/threaded BID 30633 31681 APPLE http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Return to the previous page.

Products

Solutions

Customers

Partner

Resources

Company

Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)

Industry
Compliance
Technology
Integration

Customers
Testimonials

VARS
MSSP
Technology Partners
References

Factsheets
Reports
Webinars
Events

About us
Careers
Memberships
Newsroom

© 2002-2013 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability