Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

Bugtraq ID:	37942
Class:	Access Validation Error
CVE:	CVE-2009-2901
Remote:	Yes
Local:	No
Published:	Jan 25 2010 12:00AM
Updated:	Feb 27 2014 12:22PM
Credit:	Apache Tomcat Security Team
Vulnerable:	VMWare vCenter 4.0 VMWare ESX Server 4.1 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 Sun Solaris 10 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM WebSphere Application Server Community Edition 2.0 1 IBM WebSphere Application Server Community Edition 2.0 HP Performance Manager 8.21 HP Performance Manager 8.20 HP Performance Manager 8.10 HP OpenVMS Secure Web Server 7.3 -2 HP OpenVMS Secure Web Server 7.3 -1 HP OpenVMS Secure Web Server 7.3 HP OpenVMS Secure Web Server 7.2 -2 HP OpenVMS Secure Web Server 1.2 HP OpenVMS Secure Web Server 1.1 -1 HP OpenVMS Secure Web Server 2.2 HP OpenVMS Secure Web Server 2.1-1 Gentoo Linux Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.6 Apache Software Foundation Tomcat 6.0.20 Apache Software Foundation Tomcat 6.0.18 Apache Software Foundation Tomcat 6.0.16 Apache Software Foundation Tomcat 6.0.15 Apache Software Foundation Tomcat 6.0.14 Apache Software Foundation Tomcat 6.0.13 Apache Software Foundation Tomcat 6.0.12 Apache Software Foundation Tomcat 6.0.11 Apache Software Foundation Tomcat 6.0.10 Apache Software Foundation Tomcat 6.0.9 Apache Software Foundation Tomcat 6.0.8 Apache Software Foundation Tomcat 6.0.7 Apache Software Foundation Tomcat 6.0.6 Apache Software Foundation Tomcat 6.0.5 Apache Software Foundation Tomcat 6.0.4 Apache Software Foundation Tomcat 6.0.3 Apache Software Foundation Tomcat 6.0.2 Apache Software Foundation Tomcat 6.0.1 Apache Software Foundation Tomcat 6.0 Apache Software Foundation Tomcat 5.5.28 Apache Software Foundation Tomcat 5.5.27 Apache Software Foundation Tomcat 5.5.26 Apache Software Foundation Tomcat 5.5.25 Apache Software Foundation Tomcat 5.5.24 Apache Software Foundation Tomcat 5.5.23 Apache Software Foundation Tomcat 5.5.22 Apache Software Foundation Tomcat 5.5.21 Apache Software Foundation Tomcat 5.5.20 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 Apache Software Foundation Tomcat 5.5.19 Apache Software Foundation Tomcat 5.5.18 Apache Software Foundation Tomcat 5.5.17 Apache Software Foundation Tomcat 5.5.16 Apache Software Foundation Tomcat 5.5.15 Apache Software Foundation Tomcat 5.5.14 Apache Software Foundation Tomcat 5.5.13 Apache Software Foundation Tomcat 5.5.12 Apache Software Foundation Tomcat 5.5.11 Apache Software Foundation Tomcat 5.5.10 Apache Software Foundation Tomcat 5.5.9 Apache Software Foundation Tomcat 5.5.8 Apache Software Foundation Tomcat 5.5.7 Apache Software Foundation Tomcat 5.5.6 Apache Software Foundation Tomcat 5.5.5 Apache Software Foundation Tomcat 5.5.4 Apache Software Foundation Tomcat 5.5.3 Apache Software Foundation Tomcat 5.5.2 Apache Software Foundation Tomcat 5.5.1 Apache Software Foundation Tomcat 5.5
Not Vulnerable:	VMWare ESX Server 4.1 ESX410-201101201 IBM WebSphere Application Server Community Edition 2.1.1.4 Apple Mac OS X Server 10.6.3 Apache Software Foundation Tomcat 6.0.24 Apache Software Foundation Tomcat 5.5.29

Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

Apache Tomcat is prone to an authentication-bypass vulnerability.

An attacker can gain unauthorized access to files and directories. Successful exploits may lead to other attacks.

This issue affects the following:

Tomcat 5.5.0 through 5.5.28
Tomcat 6.0.0 through 6.0.20

Other versions may also be affected.

Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

An attacker can exploit this issue through a browser.

Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.1_all.deb

Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.3.dmg
  http://www.apple.com/support/downloads/

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.1_all.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva tomcat5-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

HP Performance Manager 8.10

• HP HPPM8CPI_00001
  HP-UX (IA)
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPL_00001
  Linux
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPP_00001
  HP-UX (PA)
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPS_00001
  Solaris
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPW_00001
  Windows
  http://support.openview.hp.com/selfsolve/patches

Mandriva Linux Mandrake 2008.0

• Mandriva tomcat5-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.23-9.2.10.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.1_all.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva tomcat5-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.28-0.5.0.1mdv2010.1.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu tomcat6_6.0.18-0ubuntu6.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.18-0 ubuntu6.2_all.deb

Mandriva Linux Mandrake 2010.0

• Mandriva tomcat5-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.5.0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu tomcat6_6.0.18-0ubuntu6.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.18-0 ubuntu6.2_all.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu tomcat6_6.0.18-0ubuntu6.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.18-0 ubuntu6.2_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu tomcat6_6.0.18-0ubuntu6.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.18-0 ubuntu6.2_all.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.1_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.1_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.1_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.1_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva tomcat5-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.3mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu tomcat6_6.0.18-0ubuntu6.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.18-0 ubuntu6.2_all.deb

Mandriva Linux Mandrake 2009.1

• Mandriva tomcat5-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva tomcat5-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.2mdv2009.1.noarch.rpm
  http://www.mandriva.com/en/download/

HP Performance Manager 8.21

• HP HPPM8CPI_00001
  HP-UX (IA)
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPL_00001
  Linux
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPP_00001
  HP-UX (PA)
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPS_00001
  Solaris
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPW_00001
  Windows
  http://support.openview.hp.com/selfsolve/patches

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva tomcat5-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva tomcat5-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.3mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/

HP Performance Manager 8.20

• HP HPPM8CPI_00001
  HP-UX (IA)
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPL_00001
  Linux
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPP_00001
  HP-UX (PA)
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPS_00001
  Solaris
  http://support.openview.hp.com/selfsolve/patches


• HP HPPM8CPW_00001
  Windows
  http://support.openview.hp.com/selfsolve/patches

Apple Mac OS X Server 10.6.1

• Apple MacOSXServerUpdCombo10.6.3.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpd10.6.3.dmg
  http://www.apple.com/support/downloads/

Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

References:

• Revision 892815 (Apache Software Foundation)
  
• Revision 902650 (Apache Software Foundation)
  
• Tomcat Homepage (Apache Software Foundation)
  
• WebSphere Application Server Community Edition V2.1.1.4 - CHANGES.txt (IBM)