The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

This update of tomcat fixes several vulnerabilities :

  - CVE-2008-5515: RequestDispatcher usage can lead to     information leakage

  - CVE-2009-0033: denial of service via AJP connection

  - CVE-2009-0580: some authentication classes allow user     enumeration

  - CVE-2009-0781: XSS bug in example application cal2.jsp

  - CVE-2009-0783: replacing XML parser leads to information     leakage Additionally, non-security bugs were fixed.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1164 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer     Pages (JSP) technologies.

    It was discovered that the Red Hat Security Advisory RHSA-2007:0871 did not     address all possible flaws in the way Tomcat handles certain characters and     character sequences in cookie values. A remote attacker could use this flaw     to obtain sensitive information, such as session IDs, and then use this     information for session hijacking attacks. (CVE-2007-5333)

    Note: The fix for the CVE-2007-5333 flaw changes the default cookie     processing behavior: with this update, version 0 cookies that contain     values that must be quoted to be valid are automatically changed to version     1 cookies. To reactivate the previous, but insecure behavior, add the     following entry to the /etc/tomcat5/catalina.properties file:

    org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false

    It was discovered that request dispatchers did not properly normalize user     requests that have trailing query strings, allowing remote attackers to     send specially-crafted requests that would cause an information leak.
    (CVE-2008-5515)

    A flaw was found in the way the Tomcat AJP (Apache JServ Protocol)     connector processes AJP connections. An attacker could use this flaw to     send specially-crafted requests that would cause a temporary denial of     service. (CVE-2009-0033)

    It was discovered that the error checking methods of certain authentication     classes did not have sufficient error checking, allowing remote attackers     to enumerate (via brute force methods) usernames registered with     applications running on Tomcat when FORM-based authentication was used.
    (CVE-2009-0580)

    A cross-site scripting (XSS) flaw was found in the examples calendar     application. With some web browsers, remote attackers could use this flaw     to inject arbitrary web script or HTML via the time parameter.
    (CVE-2009-0781)

    It was discovered that web applications containing their own XML parsers     could replace the XML parser Tomcat uses to parse configuration files. A     malicious web application running on a Tomcat instance could read or,     potentially, modify the configuration and XML-based data of other web     applications deployed on the same Tomcat instance. (CVE-2009-0783)

    Users of Tomcat should upgrade to these updated packages, which contain     backported patches to resolve these issues. Tomcat must be restarted for     this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

ID	名前	製品	ファミリー	公開日	更新日	深刻度
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	medium
40316	openSUSE Security Update : tomcat6 (tomcat6-999)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
40342	RHEL 5 : tomcat (RHSA-2009:1164)	Nessus	Red Hat Local Security Checks	2009/7/22	2024/11/4	medium
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical

検出

プラグインの検索

medium

medium

medium

critical

critical