Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.807411
Category:Web Servers
Title:Apache Tomcat Limited Directory Traversal Vulnerability - Feb16 (Linux)
Summary:Apache Tomcat is prone to a limited directory traversal vulnerability.
Description:Summary:
Apache Tomcat is prone to a limited directory traversal vulnerability.

Vulnerability Insight:
The flaw is due to an improper validation of
path while accessing resources via the ServletContext methods getResource(),
getResourceAsStream() and getResourcePaths() the paths should be limited to
the current web application.

Vulnerability Impact:
Successful exploitation will allow remote
authenticated users to bypass intended SecurityManager restrictions and
list a parent directory.

Affected Software/OS:
Apache Tomcat 6.x before 6.0.45,
7.x before 7.0.65, and 8.0.0.RC1 before 8.0.27 on Linux.

Solution:
Upgrade to version 6.0.45 or 7.0.65 or
8.0.27 or later.

CVSS Score:
4.0

CVSS Vector:
AV:N/AC:L/Au:S/C:P/I:N/A:N

Cross-Ref: BugTraq ID: 83329
Common Vulnerability Exposure (CVE) ID: CVE-2015-5174
http://www.securityfocus.com/bid/83329
Bugtraq: 20160222 [SECURITY] CVE-2015-5174 Apache Tomcat Limited Directory Traversal (Google Search)
http://seclists.org/bugtraq/2016/Feb/149
Debian Security Information: DSA-3530 (Google Search)
http://www.debian.org/security/2016/dsa-3530
Debian Security Information: DSA-3552 (Google Search)
http://www.debian.org/security/2016/dsa-3552
Debian Security Information: DSA-3609 (Google Search)
http://www.debian.org/security/2016/dsa-3609
https://security.gentoo.org/glsa/201705-09
HPdes Security Advisory: HPSBUX03561
http://marc.info/?l=bugtraq&m=145974991225029&w=2
http://packetstormsecurity.com/files/135883/Apache-Tomcat-Limited-Directory-Traversal.html
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd4863c79bf729aabb95571fd845a9ea4ee3ae3fcee48f35aba007350@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r0b24f2c7507f702348e2c2d64e8a5de72bad6173658e8d8e45322ac2@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e@%3Cusers.tomcat.apache.org%3E
RedHat Security Advisories: RHSA-2016:1432
https://access.redhat.com/errata/RHSA-2016:1432
RedHat Security Advisories: RHSA-2016:1433
https://access.redhat.com/errata/RHSA-2016:1433
RedHat Security Advisories: RHSA-2016:1434
https://access.redhat.com/errata/RHSA-2016:1434
RedHat Security Advisories: RHSA-2016:1435
http://rhn.redhat.com/errata/RHSA-2016-1435.html
RedHat Security Advisories: RHSA-2016:2045
http://rhn.redhat.com/errata/RHSA-2016-2045.html
RedHat Security Advisories: RHSA-2016:2599
http://rhn.redhat.com/errata/RHSA-2016-2599.html
http://www.securitytracker.com/id/1035070
SuSE Security Announcement: SUSE-SU-2016:0769 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
SuSE Security Announcement: SUSE-SU-2016:0822 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
SuSE Security Announcement: SUSE-SU-2016:0839 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
SuSE Security Announcement: openSUSE-SU-2016:0865 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
http://www.ubuntu.com/usn/USN-3024-1
CopyrightCopyright (C) 2016 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.