Apache Tomcat DefaultServlet File Disclosure Vulnerability

Bugtraq ID:	5786
Class:	Unknown
CVE:	CVE-2002-1148
Remote:	Yes
Local:	No
Published:	Sep 24 2002 12:00AM
Updated:	Sep 05 2008 06:41PM
Credit:	Discovered by Rossen Raykov <[email protected]>.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 9 Sun Solaris 10_x86 Sun Solaris 10_sparc Sun Solaris 10 HP VirtualVault 11.0.4 Apache Tomcat 4.1.10 Apache Tomcat 4.1.9 beta Apache Tomcat 4.1.3 beta Apache Tomcat 4.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.3 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.5 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 3.3 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 4.0.4 Apache Tomcat 4.0.3 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha Apache Tomcat 4.0.2 Apache Tomcat 4.0.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 3.3 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 4.0 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.3.1 Apache Tomcat 3.3 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2.4 Apache Tomcat 3.2.3 Apache Tomcat 3.2.2 beta2 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP Secure OS software for Linux 1.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.1.1 Apache Tomcat 3.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.0 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0
Not Vulnerable:	Apache Tomcat 4.1.12 Apache Tomcat 4.0.5 + Redhat Stronghold 4.0

Apache Tomcat DefaultServlet File Disclosure Vulnerability

Issue a request for the following URL, where 'target' is the target Tomcat server/port and 'target.jsp' is the desired JSP file:

http://target/admin/servlet/org.apache.catalina.servlets.DefaultServlet/target.jsp

Apache Tomcat DefaultServlet File Disclosure Vulnerability

Solution:
Fixed versions of Tomcat are available. Please see the references for details.


Sun Solaris 9

• Sun 113146-11
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -113146-11-1


• Sun 114016-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114016-02-1

Sun Solaris 9_x86

• Sun 114017-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114017-02-1


• Sun 114145-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114145-10-1

Apache Tomcat 3.0

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.1

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.1.1

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.2

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.2.1

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.2.2 beta2

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.2.3

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.2.4

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.3

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 3.3.1

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 4.0

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 4.0.1

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 4.0.2

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 4.0.3

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/


• Debian libtomcat4-java_4.0.3-3woody1_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat4/libtomcat4-j ava_4.0.3-3woody1_all.deb


• Debian tomcat4-webapps_4.0.3-3woody1_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat4/tomcat4-weba pps_4.0.3-3woody1_all.deb


• Debian tomcat4_4.0.3-3woody1_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat4/tomcat4_4.0. 3-3woody1_all.deb

Apache Tomcat 4.0.4

• Apache Software Foundation Jakarta Tomcat 4.0.5
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/

Apache Tomcat 4.1

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Tomcat 4.1.10

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Tomcat 4.1.3 beta

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Tomcat 4.1.9 beta

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Tomcat DefaultServlet File Disclosure Vulnerability

References:

• Security Vulnerabilities in Tomcat 4.0 Shipped with Solaris 9 and 10 (Sun Microsystems)
  
• Solution 239312 : Security Vulnerabilities in Tomcat 4.0 Shipped with Solaris (Sun)