Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability

Bugtraq ID:	28484
Class:	Design Error
CVE:	CVE-2005-4703
Remote:	Yes
Local:	No
Published:	Oct 14 2005 12:00AM
Updated:	Mar 27 2008 09:59PM
Credit:	security curmudgeon <[email protected]>
Vulnerable:	Apache Tomcat 4.0.3
Not Vulnerable:	Apache Tomcat 4.1.3

Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability

Apache Tomcat is prone to an information-disclosure vulnerability when handling requests that contain MS-DOS device names.

Attackers can leverage this issue to obtain potentially sensitive data that could aid in other attacks.

Tomcat 4.0.3 running on Windows is vulnerable; other versions may also be affected.

Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability

Attackers may launch attacks through a browser.

The following example request is available:

GET /lpt9.xtp

Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability

Solution:
The vendor states that Tomcat 4.1.3 and later versions are not affected. Please see the references for more information.


Apache Tomcat 4.0.3

• Apache Software Foundation apache-tomcat-4.1.37.tar.gz
  http://mirror.lemonfree.com/apache/tomcat/tomcat-4/v4.1.37/bin/apache- tomcat-4.1.37.tar.gz

Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability

References:

• Apache Tomcat 4.0.3 MS-DOS Device Request Path Disclosure (security curmudgeon )
  
• Apache Tomcat Homepage (Apache)
  
• Apache Tomcat 4.x vulnerabilities (Apache Software Foundation)