Apache Tomcat Example Web Application Cross Site Scripting Vulnerability

Bugtraq ID:	6720
Class:	Input Validation Error
CVE:	CVE-2003-0044
Remote:	Yes
Local:	No
Published:	Jan 26 2003 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	This vulnerability was reported by the Jakarta Tomcat Team.
Vulnerable:	Apache Tomcat 3.3.1 a Apache Tomcat 3.3.1 Apache Tomcat 3.3 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2.4 Apache Tomcat 3.2.3 Apache Tomcat 3.2.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP Secure OS software for Linux 1.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.2 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.1.1 Apache Tomcat 3.1 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0 Apache Tomcat 3.0 - BSDI BSD/OS 4.0 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Debian Linux 2.1 - Digital UNIX 4.0 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4 x86 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 8_sparc - Sun Solaris 7.0
Not Vulnerable:	Apache Tomcat 3.3.1 a

Apache Tomcat Example Web Application Cross Site Scripting Vulnerability

A vulnerability has been reported for Apache Tomcat. Reportedly, it is possible for an attacker to launch a cross site scripting attack.

The cross site scripting vulnerabilities exist in some sample web applications distributed with Apache Tomcat 3.3.1a and earlier.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a host running Tomcat. Other attacks are also possible.

Apache Tomcat Example Web Application Cross Site Scripting Vulnerability

There is no exploit code required.

Apache Tomcat Example Web Application Cross Site Scripting Vulnerability

Solution:
HP has released an advisory (HPSBUX0303-249) that contains fixes to address this issue.

This issue will reportedly be addressed by the vendor in Tomcat version 3.3.2.

Fixes available:


Apache Tomcat 3.0

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.1

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.1.1

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.2

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.2.1

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.2.3

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.2.4

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat 3.3

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/


• Debian libapache-mod-jk_3.3a-4woody1_i386.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat/libapache-mod -jk_3.3a-4woody1_i386.deb


• Debian tomcat_3.3a-4woody1_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat/tomcat_3.3a-4 woody1_all.deb

Apache Tomcat 3.3.1

• Apache Software Foundation Jakarta Tomcat 3.3.1a
  http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/

Apache Tomcat Example Web Application Cross Site Scripting Vulnerability

References:

• Apache Software Foundation Homepage (Apache Software Foundation)
  
• Tomcat Homepage (Apache Software Foundation)