Red Hat Bugzilla – Bug 559742
CVE-2009-2901 tomcat: insecure partial deploy after failed undeploy
Last modified: 2015-07-29 09:15:05 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2901 to the following vulnerability: Name: CVE-2009-2901 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2901 Assigned: 20090820 Reference: BUGTRAQ:20100124 [SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy Reference: URL: http://www.securityfocus.com/archive/1/archive/1/509151/100/0/threaded Reference: CONFIRM: http://svn.apache.org/viewvc?rev=892815&view=rev Reference: CONFIRM: http://svn.apache.org/viewvc?rev=902650&view=rev Reference: CONFIRM: http://tomcat.apache.org/security-5.html Reference: CONFIRM: http://tomcat.apache.org/security-6.html Reference: BID:37942 Reference: URL: http://www.securityfocus.com/bid/37942 Reference: SECTRACK:1023503 Reference: URL: http://securitytracker.com/id?1023503 Reference: SECUNIA:38316 Reference: URL: http://secunia.com/advisories/38316 Reference: SECUNIA:38346 Reference: URL: http://secunia.com/advisories/38346 Reference: VUPEN:ADV-2010-0213 Reference: URL: http://www.vupen.com/english/advisories/2010/0213 Reference: XF:tomcat-autodeploy-security-bypass(55856) Reference: URL: http://xforce.iss.net/xforce/xfdb/55856 The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Patch is attached to https://bugzilla.redhat.com/show_bug.cgi?id=559738. Upstream fix was checked in as one submission
tomcat5 and tomcat6 released with JBoss Enterprise Web Server 1.0.1 for Windows include a fix for this issue.