Red Hat Bugzilla – Bug 427216
CVE-2007-5342 Apache Tomcat's default security policy is too open
Last modified: 2010-12-22 17:36:50 EST
Generally it is a bad idea to grant java.security.AllPermission
in java security policy files. This is the case for
the tomcat-juli.jar, part of the logging framework
for Apache Tomcat.
CVE description from Mitre:
The default catalina.policy in the JULI logging component in Apache
Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict
certain permissions for web applications, which allows attackers to
modify logging configuration options and overwrite arbitrary files, as
demonstrated by changing the (1) level, (2) directory, and (3) prefix
attributes in the org.apache.juli.FileHandler handler.
tomcat5-5.5.26-1jpp.1.fc7 has been submitted as an update for Fedora 7
tomcat5-5.5.26-1jpp.1.fc8 has been submitted as an update for Fedora 8
tomcat5-5.5.26-1jpp.2.fc8 has been submitted as an update for Fedora 8
tomcat5-5.5.26-1jpp.2.fc7 has been submitted as an update for Fedora 7
tomcat5-5.5.26-1jpp.2.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
tomcat5-5.5.26-1jpp.2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
This was addressed via:
Red Hat Enterprise Linux version 5 (RHSA-2008:0042)
Red Hat Developer Suite v.3 (AS v.4) (RHSA-2008:0195)
JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS (RHSA-2008:0831)
JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server (RHSA-2008:0832)
JBoss Enterprise Application Platform for RHEL 4 AS (RHSA-2008:0833)
JBoss Enterprise Application Platform for RHEL 5 Server (RHSA-2008:0834)
Red Hat Application Server v2 4AS (RHSA-2008:0862)