Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2693 to the following vulnerability: Name: CVE-2009-2693 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693 Assigned: 20090805 Reference: BUGTRAQ:20100124 [SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration Reference: URL: http://www.securityfocus.com/archive/1/archive/1/509148/100/0/threaded Reference: CONFIRM: http://svn.apache.org/viewvc?rev=892815&view=rev Reference: CONFIRM: http://svn.apache.org/viewvc?rev=902650&view=rev Reference: CONFIRM: http://tomcat.apache.org/security-5.html Reference: CONFIRM: http://tomcat.apache.org/security-6.html Reference: BID:37944 Reference: URL: http://www.securityfocus.com/bid/37944 Reference: SECTRACK:1023505 Reference: URL: http://securitytracker.com/id?1023505 Reference: SECUNIA:38316 Reference: URL: http://secunia.com/advisories/38316 Reference: SECUNIA:38346 Reference: URL: http://secunia.com/advisories/38346 Reference: VUPEN:ADV-2010-0213 Reference: URL: http://www.vupen.com/english/advisories/2010/0213 Reference: XF:tomcat-war-directory-traversal(55855) Reference: URL: http://xforce.iss.net/xforce/xfdb/55855 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry
Created attachment 389583 [details] Patch for all three CVEs
Comment on attachment 389583 [details] Patch for all three CVEs The changes for these three CVEs were submitted as one revision. This patch file effects all three CVEs. See http://tomcat.apache.org/security-5.html
This issue has been addressed in following products: JBEWS 1.0.0 for RHEL 4 JBEWS 1.0.0 for RHEL 5 Via RHSA-2010:0119 https://rhn.redhat.com/errata/RHSA-2010-0119.html
I started working on Fedora updates.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0580 https://rhn.redhat.com/errata/RHSA-2010-0580.html
This issue has been addressed in following products: RHAPS Version 2 for RHEL 4 Via RHSA-2010:0582 https://rhn.redhat.com/errata/RHSA-2010-0582.html
This issue has been addressed in following products: Red Hat Certificate System 7.3 Via RHSA-2010:0693 https://rhn.redhat.com/errata/RHSA-2010-0693.html