Bug 1311089 (CVE-2015-5345) - CVE-2015-5345 tomcat: directory disclosure
Summary: CVE-2015-5345 tomcat: directory disclosure
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-5345
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1311095 1311102 1315991 1315993 1322812 1322813 1347135 1347136 1347240 1352009 1367054 1367055 1381948
Blocks: 1311109 1318206
TreeView+ depends on / blocked
 
Reported: 2016-02-23 11:09 UTC by Andrej Nemec
Modified: 2021-02-17 04:19 UTC (History)
12 users (show)

Fixed In Version: tomcat 6.0.45, tomcat 7.0.67, tomcat 8.0.30
Doc Type: Bug Fix
Doc Text:
It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.
Clone Of:
Environment:
Last Closed: 2019-06-08 02:48:42 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1087 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Web Server 3.0.3 update 2016-05-17 20:31:38 UTC
Red Hat Product Errata RHSA-2016:1088 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Web Server 3.0.3 update 2016-05-17 20:30:35 UTC
Red Hat Product Errata RHSA-2016:1089 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Web Server 3.0.3 security update 2016-05-17 20:12:21 UTC
Red Hat Product Errata RHSA-2016:2045 0 normal SHIPPED_LIVE Important: tomcat6 security and bug fix update 2016-10-11 00:38:52 UTC
Red Hat Product Errata RHSA-2016:2599 0 normal SHIPPED_LIVE Moderate: tomcat security, bug fix, and enhancement update 2016-11-03 12:12:12 UTC

Description Andrej Nemec 2016-02-23 11:09:02 UTC 
When accessing a directory protected by a security constraint with a URL
that did not end in a slash, Tomcat would redirect to the URL with the
trailing slash thereby confirming the presence of the directory before
processing the security constraint. It was therefore possible for a user
to determine if a directory existed or not, even if the user was not
permitted to view the directory. The issue also occurred at the root of
a web application in which case the presence of the web application was
confirmed, even if a user did not have access.

External references:

http://seclists.org/bugtraq/2016/Feb/146
Comment 1 Andrej Nemec 2016-02-23 12:00:26 UTC 
Upstream patches:

Tomcat6:

http://svn.apache.org/viewvc?view=revision&revision=1715216
http://svn.apache.org/viewvc?view=revision&revision=1717216

Tomcat7:

http://svn.apache.org/viewvc?view=revision&revision=1715213
http://svn.apache.org/viewvc?view=revision&revision=1717212
http://svn.apache.org/viewvc?view=revision&revision=1716860

Tomcat8:

http://svn.apache.org/viewvc?view=revision&revision=1715207
http://svn.apache.org/viewvc?view=revision&revision=1717209
Comment 6 errata-xmlrpc 2016-05-17 16:16:02 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3.0.3

Via RHSA-2016:1089 https://rhn.redhat.com/errata/RHSA-2016-1089.html
Comment 7 errata-xmlrpc 2016-05-17 16:32:47 UTC 
This issue has been addressed in the following products:

  JWS 3.0 for RHEL 7

Via RHSA-2016:1088 https://access.redhat.com/errata/RHSA-2016:1088
Comment 8 errata-xmlrpc 2016-05-17 16:33:58 UTC 
This issue has been addressed in the following products:

  JWS 3.0 for RHEL 6

Via RHSA-2016:1087 https://access.redhat.com/errata/RHSA-2016:1087
Comment 13 Fedora Update System 2016-09-01 16:18:52 UTC 
tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2016-09-02 09:20:47 UTC 
tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 16 errata-xmlrpc 2016-10-10 20:42:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:2045 https://rhn.redhat.com/errata/RHSA-2016-2045.html
Comment 17 errata-xmlrpc 2016-11-03 21:11:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2599 https://rhn.redhat.com/errata/RHSA-2016-2599.html
Note You need to log in before you can comment on or make changes to this bug.