CVE ID:	CVE-2003-0042
Description:	Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0042 BugTraq ID: 6721 http://www.securityfocus.com/bid/6721 Bugtraq: 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability (Google Search) http://marc.info/?l=bugtraq&m=104394568616290&w=2 Computer Incident Advisory Center Bulletin: N-060 http://www.ciac.org/ciac/bulletins/n-060.shtml Debian Security Information: DSA-246 (Google Search) http://www.debian.org/security/2003/dsa-246 HPdes Security Advisory: HPSBUX0303-249 http://www.securityfocus.com/advisories/5111 http://secunia.com/advisories/7972 http://secunia.com/advisories/7977 XForce ISS Database: tomcat-null-directory-listing(11194) https://exchange.xforce.ibmcloud.com/vulnerabilities/11194