Apache Tomcat Java Security Manager Bypass Vulnerability

Bugtraq ID:	13756
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2001 12:00AM
Updated:	Jan 06 2001 12:00AM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Sun SunOS 5.9 _x86 Sun SunOS 5.9 Apache Tomcat 4.0.2 Apache Tomcat 4.0.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 3.3 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 4.0 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.3.1 a Apache Tomcat 3.3.1 Apache Tomcat 3.3 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2.4 Apache Tomcat 3.2.3 Apache Tomcat 3.2.2 beta2 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP Secure OS software for Linux 1.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.1.1 Apache Tomcat 3.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.0 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0
Not Vulnerable:	Apache Tomcat 4.0.3 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha

Apache Tomcat Java Security Manager Bypass Vulnerability

Apache Tomcat is susceptible to a Java Security Manager sandbox bypass vulnerability. The issue may be leveraged using the request dispatcher to bypass the Java Security Manager.

Information that is harvested through the exploitation of this vulnerability may be used to aid in further attacks.

Apache Tomcat Java Security Manager Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Apache Tomcat Java Security Manager Bypass Vulnerability

Solution:
The vendor has released version 4.0.3 to address this issue.

Sun has released patches to address this issue:


Apache Tomcat 3.0

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.1

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.1.1

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.2

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.2.1

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.2.2 beta2

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.2.3

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.2.4

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.3

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.3.1

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 3.3.1 a

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 4.0

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 4.0.1

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Apache Tomcat 4.0.2

• Apache Software Foundation Apache Tomcat 4.0.3
  http://freshmeat.net/projects/tomcat/?branch_id=19610&release_id=71412

Sun SunOS 5.9

• Sun 114016-01
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=114016-01&method=f

Sun SunOS 5.9 _x86

• Sun 114017-01
  http://sunsolve.sun.com/pub-cgi/pdownload.pl?target=114017-01&method=f

Apache Tomcat Java Security Manager Bypass Vulnerability

References:

• Apache Tomcat 4.0.3 (4.1.x) (Apache Software Foundation)
  
• 114016-01 - tomcat security patch (Sun)
  
• 114017-01 - SunOS 5.9_x86: tomcat security patch (Sun)