Bug 559742 (CVE-2009-2901)

Summary:	CVE-2009-2901 tomcat: insecure partial deploy after failed undeploy
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dbhole, devrim, dknox, dwalluck, pcheung, qe-baseos-daemons, rafaels, viveklak
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2901
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-02 14:15:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	585370
Bug Blocks:

Description Vincent Danen 2010-01-28 21:16:26 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2901 to
the following vulnerability:

Name: CVE-2009-2901
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2901
Assigned: 20090820
Reference: BUGTRAQ:20100124 [SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/509151/100/0/threaded
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=892815&view=rev
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=902650&view=rev
Reference: CONFIRM: http://tomcat.apache.org/security-5.html
Reference: CONFIRM: http://tomcat.apache.org/security-6.html
Reference: BID:37942
Reference: URL: http://www.securityfocus.com/bid/37942
Reference: SECTRACK:1023503
Reference: URL: http://securitytracker.com/id?1023503
Reference: SECUNIA:38316
Reference: URL: http://secunia.com/advisories/38316
Reference: SECUNIA:38346
Reference: URL: http://secunia.com/advisories/38346
Reference: VUPEN:ADV-2010-0213
Reference: URL: http://www.vupen.com/english/advisories/2010/0213
Reference: XF:tomcat-autodeploy-security-bypass(55856)
Reference: URL: http://xforce.iss.net/xforce/xfdb/55856

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and
6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase
files that remain from a failed undeploy, which might allow remote
attackers to bypass intended authentication requirements via HTTP
requests.

Comment 1 David Knox 2010-02-08 18:04:13 UTC

Patch is attached to https://bugzilla.redhat.com/show_bug.cgi?id=559738. Upstream fix was checked in as one submission

Comment 2 Tomas Hoger 2010-03-02 14:15:52 UTC

tomcat5 and tomcat6 released with JBoss Enterprise Web Server 1.0.1 for Windows include a fix for this issue.