Apache Tomcat unexpected file deletion and/or alteration-白红宇

Apache Tomcat unexpected file deletion and/or alteration

阅读量：2435 次

发布时间：2019-05-10

本文共 1261 字，大约阅读时间需要 4 分钟。

http://www.securityfocus.com/archive/1/archive/1/509148/100/0/threaded

Severity: Low

Vendor:

The Apache Software Foundation

Versions Affected:

Tomcat 5.5.0 to 5.5.28

Tomcat 6.0.0 to 6.0.20

The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be also

affected.

Description:

When deploying WAR files, the WAR files were not checked for directory

traversal attempts. This allows an attacker to create arbitrary content

outside of the web root.

Mitigation:

6.0.x users should upgrade to 6.0.24 or apply this patch:

http://svn.apache.org/viewvc?rev=892815&view=rev

5.5.x users should upgrade to 5.5.29 when released or apply this patch:

http://svn.apache.org/viewvc?rev=902650&view=rev

Note: the patches also address CVE-2009-2901 and CVE-2009-2902.

Alternatively, users of all Tomcat versions may mitigate this issue by

manually validating the contents of untrusted WAR files before deployment.

Example:

A WAR file that contains the following entry will overwrite the standard

Windows start-up script when deployed on a default Tomcat installation:

../../bin/catalina.bat

Credit:

This issue was reported to the Apache Tomcat security team by Marc

Schoenefeld of the Red Hat Security Response Team

References:

[1] http://tomcat.apache.org/security.html

Mark Thomas

转载地址：http://atqmb.baihongyu.com/

你可能感兴趣的文章

武大网络预赛 Problem 1545 - I - Twenty-four

查看>>

ZOJ Problem Set - 3768 Continuous Login

UVALive 6755 - Swyper Keyboard

查看>>

uva_11029 Leading and Trailing 快速幂数的n次方前几位

查看>>

uva10023 手算开方的方法

查看>>

欧拉函数——从容斥定理和积性函数的性质谈开