Bug 559738 (CVE-2009-2693) - CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
Summary: CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
Status: CLOSED ERRATA
Alias: CVE-2009-2693
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://web.nvd.nist.gov/view/vuln/det...
Whiteboard: impact=low,source=cve,reported=201001...
Keywords: Security
Depends On: 584514 585370 613004 613005 614422 616751
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-01-28 21:09 UTC by Vincent Danen
Modified: 2013-03-11 04:51 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-03-11 04:51:15 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch for all three CVEs (20.52 KB, patch)
2010-02-08 17:39 UTC, David Knox
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0119 normal SHIPPED_LIVE Low: JBoss Enterprise Web Server 1.0.1 update 2010-02-23 20:20:08 UTC
Red Hat Product Errata RHSA-2010:0580 normal SHIPPED_LIVE Important: tomcat5 security update 2010-08-02 20:00:06 UTC
Red Hat Product Errata RHSA-2010:0582 normal SHIPPED_LIVE Important: tomcat5 security update 2010-08-02 20:17:44 UTC
Red Hat Product Errata RHSA-2010:0693 normal SHIPPED_LIVE Important: tomcat5 security update 2010-09-10 08:37:13 UTC

Description Vincent Danen 2010-01-28 21:09:36 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2693 to
the following vulnerability:

Name: CVE-2009-2693
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693
Assigned: 20090805
Reference: BUGTRAQ:20100124 [SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/509148/100/0/threaded
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=892815&view=rev
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=902650&view=rev
Reference: CONFIRM: http://tomcat.apache.org/security-5.html
Reference: CONFIRM: http://tomcat.apache.org/security-6.html
Reference: BID:37944
Reference: URL: http://www.securityfocus.com/bid/37944
Reference: SECTRACK:1023505
Reference: URL: http://securitytracker.com/id?1023505
Reference: SECUNIA:38316
Reference: URL: http://secunia.com/advisories/38316
Reference: SECUNIA:38346
Reference: URL: http://secunia.com/advisories/38346
Reference: VUPEN:ADV-2010-0213
Reference: URL: http://www.vupen.com/english/advisories/2010/0213
Reference: XF:tomcat-war-directory-traversal(55855)
Reference: URL: http://xforce.iss.net/xforce/xfdb/55855

Directory traversal vulnerability in Apache Tomcat 5.5.0 through
5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or
overwrite arbitrary files via a .. (dot dot) in an entry in a WAR
file, as demonstrated by a ../../bin/catalina.bat entry

Comment 2 David Knox 2010-02-08 17:39:20 UTC
Created attachment 389583 [details]
Patch for all three CVEs

Comment 3 David Knox 2010-02-08 17:42:17 UTC
Comment on attachment 389583 [details]
Patch for all three CVEs

The changes for these three CVEs were submitted as one revision. This patch file effects all three CVEs.
See http://tomcat.apache.org/security-5.html

Comment 4 errata-xmlrpc 2010-02-23 20:20:25 UTC
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4
  JBEWS 1.0.0 for RHEL 5

Via RHSA-2010:0119 https://rhn.redhat.com/errata/RHSA-2010-0119.html

Comment 5 Devrim Gündüz 2010-03-02 14:27:30 UTC
I started working on Fedora updates.

Comment 10 errata-xmlrpc 2010-08-02 20:00:15 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0580 https://rhn.redhat.com/errata/RHSA-2010-0580.html

Comment 11 errata-xmlrpc 2010-08-02 20:17:52 UTC
This issue has been addressed in following products:

  RHAPS Version 2 for RHEL 4

Via RHSA-2010:0582 https://rhn.redhat.com/errata/RHSA-2010-0582.html

Comment 12 errata-xmlrpc 2010-09-10 08:37:27 UTC
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0693 https://rhn.redhat.com/errata/RHSA-2010-0693.html


Note You need to log in before you can comment on or make changes to this bug.