Bug 559738 - (CVE-2009-2693) CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
http://web.nvd.nist.gov/view/vuln/det...
impact=low,source=cve,reported=201001...
: Security
Depends On: 584514 585370 613004 613005 614422 616751
Blocks:
  Show dependency treegraph
 
Reported: 2010-01-28 16:09 EST by Vincent Danen
Modified: 2013-03-11 00:51 EDT (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-03-11 00:51:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch for all three CVEs (20.52 KB, patch)
2010-02-08 12:39 EST, David Knox
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0119 normal SHIPPED_LIVE Low: JBoss Enterprise Web Server 1.0.1 update 2010-02-23 15:20:08 EST
Red Hat Product Errata RHSA-2010:0580 normal SHIPPED_LIVE Important: tomcat5 security update 2010-08-02 16:00:06 EDT
Red Hat Product Errata RHSA-2010:0582 normal SHIPPED_LIVE Important: tomcat5 security update 2010-08-02 16:17:44 EDT
Red Hat Product Errata RHSA-2010:0693 normal SHIPPED_LIVE Important: tomcat5 security update 2010-09-10 04:37:13 EDT

  None (edit)
Description Vincent Danen 2010-01-28 16:09:36 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2693 to
the following vulnerability:

Name: CVE-2009-2693
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693
Assigned: 20090805
Reference: BUGTRAQ:20100124 [SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/509148/100/0/threaded
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=892815&view=rev
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=902650&view=rev
Reference: CONFIRM: http://tomcat.apache.org/security-5.html
Reference: CONFIRM: http://tomcat.apache.org/security-6.html
Reference: BID:37944
Reference: URL: http://www.securityfocus.com/bid/37944
Reference: SECTRACK:1023505
Reference: URL: http://securitytracker.com/id?1023505
Reference: SECUNIA:38316
Reference: URL: http://secunia.com/advisories/38316
Reference: SECUNIA:38346
Reference: URL: http://secunia.com/advisories/38346
Reference: VUPEN:ADV-2010-0213
Reference: URL: http://www.vupen.com/english/advisories/2010/0213
Reference: XF:tomcat-war-directory-traversal(55855)
Reference: URL: http://xforce.iss.net/xforce/xfdb/55855

Directory traversal vulnerability in Apache Tomcat 5.5.0 through
5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or
overwrite arbitrary files via a .. (dot dot) in an entry in a WAR
file, as demonstrated by a ../../bin/catalina.bat entry
Comment 2 David Knox 2010-02-08 12:39:20 EST
Created attachment 389583 [details]
Patch for all three CVEs
Comment 3 David Knox 2010-02-08 12:42:17 EST
Comment on attachment 389583 [details]
Patch for all three CVEs

The changes for these three CVEs were submitted as one revision. This patch file effects all three CVEs.
See http://tomcat.apache.org/security-5.html
Comment 4 errata-xmlrpc 2010-02-23 15:20:25 EST
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4
  JBEWS 1.0.0 for RHEL 5

Via RHSA-2010:0119 https://rhn.redhat.com/errata/RHSA-2010-0119.html
Comment 5 Devrim Gündüz 2010-03-02 09:27:30 EST
I started working on Fedora updates.
Comment 10 errata-xmlrpc 2010-08-02 16:00:15 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0580 https://rhn.redhat.com/errata/RHSA-2010-0580.html
Comment 11 errata-xmlrpc 2010-08-02 16:17:52 EDT
This issue has been addressed in following products:

  RHAPS Version 2 for RHEL 4

Via RHSA-2010:0582 https://rhn.redhat.com/errata/RHSA-2010-0582.html
Comment 12 errata-xmlrpc 2010-09-10 04:37:27 EDT
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0693 https://rhn.redhat.com/errata/RHSA-2010-0693.html

Note You need to log in before you can comment on or make changes to this bug.