Bug 1311089 (CVE-2015-5345)

Summary:	CVE-2015-5345 tomcat: directory disclosure
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	csutherl, dknox, jclere, jdoyle, lgao, mbabacek, myarboro, pslavice, rsvoboda, twalsh, weli, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tomcat 6.0.45, tomcat 7.0.67, tomcat 8.0.30	Doc Type:	Bug Fix
Doc Text:	It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:48:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1311095, 1311102, 1315991, 1315993, 1322812, 1322813, 1347135, 1347136, 1347240, 1352009, 1367054, 1367055, 1381948
Bug Blocks:	1311109, 1318206

Description Andrej Nemec 2016-02-23 11:09:02 UTC

When accessing a directory protected by a security constraint with a URL
that did not end in a slash, Tomcat would redirect to the URL with the
trailing slash thereby confirming the presence of the directory before
processing the security constraint. It was therefore possible for a user
to determine if a directory existed or not, even if the user was not
permitted to view the directory. The issue also occurred at the root of
a web application in which case the presence of the web application was
confirmed, even if a user did not have access.

External references:

http://seclists.org/bugtraq/2016/Feb/146

Comment 1 Andrej Nemec 2016-02-23 12:00:26 UTC

Upstream patches:

Tomcat6:

http://svn.apache.org/viewvc?view=revision&revision=1715216
http://svn.apache.org/viewvc?view=revision&revision=1717216

Tomcat7:

http://svn.apache.org/viewvc?view=revision&revision=1715213
http://svn.apache.org/viewvc?view=revision&revision=1717212
http://svn.apache.org/viewvc?view=revision&revision=1716860

Tomcat8:

http://svn.apache.org/viewvc?view=revision&revision=1715207
http://svn.apache.org/viewvc?view=revision&revision=1717209

Comment 6 errata-xmlrpc 2016-05-17 16:16:02 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3.0.3

Via RHSA-2016:1089 https://rhn.redhat.com/errata/RHSA-2016-1089.html

Comment 7 errata-xmlrpc 2016-05-17 16:32:47 UTC

This issue has been addressed in the following products:

  JWS 3.0 for RHEL 7

Via RHSA-2016:1088 https://access.redhat.com/errata/RHSA-2016:1088

Comment 8 errata-xmlrpc 2016-05-17 16:33:58 UTC

This issue has been addressed in the following products:

  JWS 3.0 for RHEL 6

Via RHSA-2016:1087 https://access.redhat.com/errata/RHSA-2016:1087

Comment 13 Fedora Update System 2016-09-01 16:18:52 UTC

tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2016-09-02 09:20:47 UTC

tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 16 errata-xmlrpc 2016-10-10 20:42:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:2045 https://rhn.redhat.com/errata/RHSA-2016-2045.html

Comment 17 errata-xmlrpc 2016-11-03 21:11:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2599 https://rhn.redhat.com/errata/RHSA-2016-2599.html