Bug 675792 - (CVE-2010-3718) CVE-2010-3718 tomcat: file permission bypass flaw
CVE-2010-3718 tomcat: file permission bypass flaw
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20110205,reported=20110205,sou...
: Security
Depends On: 675794 675795 675923 675924 675925 675926 675931 675933 802294
Blocks:
  Show dependency treegraph
 
Reported: 2011-02-07 13:55 EST by Vincent Danen
Modified: 2013-04-10 14:50 EDT (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-10 14:50:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2011-02-07 13:55:27 EST
Apache Tomcat 5.5.30 and 6.0.30 were released [1],[2] to fix, among other things, a bypass of security manager file permissions.  The work directory that web applications are granted read/write access is determined by a ServletContext attribute that is supposed to be a read-only attribute to web applications.  Due to a coding error, a web application could modify the attribute before Tomcat applied file permissions, which could allow a malicious web application to set the work directory to any area of the file system, granting that web application read/write permissions to the specified directory.

This vulnerability is only applicable in environments that host web applications from untrusted sources, such as in shared hosting environments.

For Tomcat 5.5.x, this was fixed in upstream revision 1027610 [4] and for Tomcat 6.x it was fixed in upstream revision 1022560 [5].

[1] http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.30
[2] http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30
[3] http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0074.html
[4] http://svn.apache.org/viewvc?rev=1027610&view=rev
[5] http://svn.apache.org/viewvc?rev=1022560&view=rev
Comment 1 Vincent Danen 2011-02-07 14:02:26 EST
Created tomcat6 tracking bugs for this issue

Affects: fedora-all [bug 675794]
Comment 2 Vincent Danen 2011-02-07 14:02:29 EST
Created tomcat5 tracking bugs for this issue

Affects: fedora-all [bug 675795]
Comment 10 errata-xmlrpc 2011-05-19 06:58:25 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0791 https://rhn.redhat.com/errata/RHSA-2011-0791.html
Comment 11 errata-xmlrpc 2011-05-19 10:29:23 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0791 https://rhn.redhat.com/errata/RHSA-2011-0791.html
Comment 12 errata-xmlrpc 2011-06-22 19:17:09 EDT
This issue has been addressed in following products:

  JBoss Enterprise Web Server 1.0

Via RHSA-2011:0896 https://rhn.redhat.com/errata/RHSA-2011-0896.html
Comment 13 errata-xmlrpc 2011-06-22 19:38:45 EDT
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 4
  JBEWS 1 for RHEL 6

Via RHSA-2011:0897 https://rhn.redhat.com/errata/RHSA-2011-0897.html
Comment 15 errata-xmlrpc 2011-12-20 12:25:54 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1845 https://rhn.redhat.com/errata/RHSA-2011-1845.html
Comment 16 Vincent Danen 2011-12-20 12:46:30 EST
Statement:

(none)

Note You need to log in before you can comment on or make changes to this bug.