Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 201592

Summary:	CVE-2006-3835 tomcat directory listing leak (RHAPS2)
Product:	[Retired] Red Hat Application Server	Reporter:	Marcel Holtmann <holtmann>
Component:	tomcat	Assignee:	Fernando Nasser <fnasser>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	2.0	CC:	patrickm, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=moderate,source=cve,reported=20060724,public=20060721
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-08-18 20:23:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marcel Holtmann 2006-08-07 17:47:31 UTC

ScanAlert Security Advisory:

http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0467.html

Apache Tomcat can be forced to reveal a complete directory listing for any
directory by requesting a mapped file extension prepended with a semicolon, a
reserved character. The file does not need to exist.

Comment 4 Marcel Holtmann 2006-08-18 20:22:31 UTC

Check bug 201915 for additional information.