Technical Description

Multiple vulnerabilities have been identified in Apache Tomcat, which could be exploited by attackes to bypass security restrictions or gain knowledge of sensitive information.

The first issue is caused by an error when handling exceptions while processing parameters, which could cause parameters supplied with a request to be incorrectly processed as part of a following request.

The second vulnerability is caused by an input validation error when handling quotes or "%5C" within cookie values, which could be exploited to disclose sensitive information. This issue is related to : VUPEN/ADV-2007-2902

The third issue is caused by an error in the native (APR based) connector when handling client connections, which could cause the application to handle a duplicate copy of one of the recent requests.

Affected Products

Apache Tomcat versions prior to 6.0.16
Apache Tomcat versions prior to 5.5.26
Apache Tomcat version 4.1.36 and prior

Solution

Upgrade to Apache Tomcat version 6.0.16 or 5.5.26 :
http://archive.apache.org/dist/tomcat/

Patches for Tomcat 4.x are available via SVN :
http://tomcat.apache.org/svn.html

References

http://www.vupen.com/english/advisories/2008/0488
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html

Credits

Vulnerabilities reported by Chitrapandian N (AdventNet), Ishikawa Yoshihiro via JPCERT/CC, and System Core.

ChangeLog

2008-02-11 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.