From announcevaughneric@example.org Wed Jun 03 13:05:34 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 40786 invoked from network); 3 Jun 2009 13:05:33 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 3 Jun 2009 13:05:33 -0000
Received: (qmail 96025 invoked by uid 500); 3 Jun 2009 13:05:46 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 96009 invoked by uid 500); 3 Jun 2009 13:05:46 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 85110 invoked by uid 99); 3 Jun 2009 13:04:42 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (athena.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Wed, 03 Jun 2009 14:03:54 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org, 
 Tomcat Users List <vaughneric@example.org>,
 Tomcat Developers List <vaughneric@example.org>
Subject: [ANN] New Tomcat announce list
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

All,

In response to popular demand, we have added an announce list to the
collection of Tomcat mailing lists. This list is open to anyone to
subscribe but only committers may post. It will be used to announce
releases, security vulnerabilities and other similar project announcements.

To subscribe, send a blank email to:
vaughneric@example.org

Further information is available from the Tomcat website:
http://tomcat.apache.org/lists.html

Enjoy!

The Apache Tomcat Team



From announcevaughneric@example.org Wed Jun 03 15:47:46 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 63562 invoked from network); 3 Jun 2009 15:47:46 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 3 Jun 2009 15:47:46 -0000
Received: (qmail 5786 invoked by uid 500); 3 Jun 2009 15:47:58 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 5760 invoked by uid 500); 3 Jun 2009 15:47:58 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 92369 invoked by uid 99); 3 Jun 2009 15:42:54 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Wed, 03 Jun 2009 16:42:06 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org, 
 Tomcat Users List <vaughneric@example.org>,
 Tomcat Developers List <vaughneric@example.org>, 
 vaughneric@example.org, vaughneric@example.org
Subject: [SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2009-0033: Apache Tomcat denial of service vulnerability

Severity: important

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39

The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.

Description:
If Tomcat receives a request with invalid headers via the Java AJP
connector, it does not return an error and instead closes the AJP
connection. In case this connector is member of a mod_jk load balancing
worker, this member will be put into an error state and will be blocked
from use for approximately one minute. Thus the behaviour can be used
for a denial of service attack using a carefully crafted request.

Mitigation:
6.0.x users should do one of the following:
 - upgrade to 6.0.20
 - apply this patch http://svn.apache.org/viewvc?rev=742915&view=rev
5.5.x users should do one of the following:
 - upgrade to 5.5.28 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781362&view=rev
4.1.x users should do one of the following:
 - upgrade to 4.1.40 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781362&view=rev

Example:
GET /servlets-examples/ HTTP/1.1
Host: localhost:x

Credit:
This issue was discovered by Yoshihito Fukuyama.

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-4.html

The Apache Tomcat Security Team


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkommc4ACgkQb7IeiTPGAkNJNACePbuHUz9m9P/lR/+hfhXh4TpL
V+EAnRjaiXwAkLJROzGDQebAqyNchEJt
=OHhB
-----END PGP SIGNATURE-----


From announcevaughneric@example.org Wed Jun 03 15:48:06 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 63609 invoked from network); 3 Jun 2009 15:48:04 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 3 Jun 2009 15:48:04 -0000
Received: (qmail 5858 invoked by uid 500); 3 Jun 2009 15:48:16 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 5833 invoked by uid 500); 3 Jun 2009 15:48:16 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 94894 invoked by uid 99); 3 Jun 2009 15:42:59 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Wed, 03 Jun 2009 16:42:01 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org, 
 Tomcat Users List <vaughneric@example.org>,
 Tomcat Developers List <vaughneric@example.org>, 
 vaughneric@example.org, vaughneric@example.org
Subject: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability
 with FORM authentication
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2009-0580: Tomcat information disclosure vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to 5.5.27
Tomcat 6.0.0 to 6.0.18

The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.

Description:
Due to insufficient error checking in some authentication classes,
Tomcat allows for the enumeration (brute force testing) of usernames by
supplying illegally URL encoded passwords. The attack is possible if
form based authenticiaton (j_security_check) with one of the following
authentication realms is used:
 * MemoryRealm
 * DataSourceRealm
 * JDBCRealm

Mitigation:
6.0.x users should do one of the following:
 - upgrade to 6.0.20
 - apply this patch http://svn.apache.org/viewvc?rev=747840&view=rev
5.5.x users should do one of the following:
 - upgrade to 5.5.28 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781379&view=rev
4.1.x users should do one of the following:
 - upgrade to 4.1.40 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781382&view=rev

Example:
The following POST request should trigger an error (500 server error or
empty response, depending on the configuration) if the ROOT web
application is configured to use FORM authentication:

POST /j_security_check HTTP/1.1
Host: localhost

j_username=tomcat&j_password=%

Credit:
This issue was discovered by D. Matscheko and T. Hackner of SEC Consult.

References:
http://tomcat.apache.org/security.html

Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkommckACgkQb7IeiTPGAkP75ACg7XYuld/25X2ltLLTeeQx88UB
pFgAn1f6mIpzU7QUnjF4lsHcR+6lY67B
=a0AC
-----END PGP SIGNATURE-----


From announcevaughneric@example.org Thu Jun 04 12:54:54 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 19661 invoked from network); 4 Jun 2009 12:54:53 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 4 Jun 2009 12:54:53 -0000
Received: (qmail 54050 invoked by uid 500); 4 Jun 2009 12:55:06 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 54025 invoked by uid 500); 4 Jun 2009 12:55:05 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 45245 invoked by uid 99); 4 Jun 2009 12:53:27 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (athena.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Thu, 04 Jun 2009 13:52:49 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org
CC: Tomcat Developers List <vaughneric@example.org>, 
 Tomcat Users List <vaughneric@example.org>,
 vaughneric@example.org, vaughneric@example.org
Subject: [SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2009-0783: Apache Tomcat information disclosure vulnerability

Severity: low

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39

The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.

Description:
Bugs https://issues.apache.org/bugzilla/show_bug.cgi?id=29936 and
https://issues.apache.org/bugzilla/show_bug.cgi?id=45933 allowed a web
application to replace the XML parser used by Tomcat to process web.xml,
context.xml and tld files. If a web application is the first web
application loaded, these bugs allow that web application to potentially
view and/or alter the web.xml, context.xml and tld files of other web
applications deployed on the Tomcat instance.

Mitigation:
6.0.x users should do one of the following:
 - upgrade to 6.0.20
 - apply these patches
   - http://svn.apache.org/viewvc?rev=739522&view=rev
   - http://svn.apache.org/viewvc?rev=652592&view=rev
5.5.x users should do one of the following:
 - upgrade to 5.5.28 when released
 - apply these patches
   - http://svn.apache.org/viewvc?rev=781542&view=rev
   - http://svn.apache.org/viewvc?rev=681156&view=rev
4.1.x users should do one of the following:
 - upgrade to 4.1.40 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781708&view=rev

Example:
See https://issues.apache.org/bugzilla/show_bug.cgi?id=29936#c12 for an
example web application that can be used to replace the XML parser used
by Tomcat.

Credit:
The security implications of these bugs was discovered and reported to
the Apache Software Foundation by Philippe Prados.


References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-4.html

The Apache Tomcat Security Team


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkonw6EACgkQb7IeiTPGAkM8qACgyxH+hBK4r4DprZhIqd97x/V1
/7EAnRMaJsKIoPzBQgOtOhM3vOCtyL+F
=B+Gu
-----END PGP SIGNATURE-----


From announcevaughneric@example.org Fri Jun 05 11:25:41 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 1280 invoked from network); 5 Jun 2009 11:25:41 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 5 Jun 2009 11:25:41 -0000
Received: (qmail 16604 invoked by uid 500); 5 Jun 2009 11:25:53 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 16557 invoked by uid 500); 5 Jun 2009 11:25:53 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 98038 invoked by uid 99); 5 Jun 2009 11:13:26 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Fri, 05 Jun 2009 12:12:45 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org, 
 Tomcat Users List <vaughneric@example.org>,
 Tomcat Developers List <vaughneric@example.org>, 
 vaughneric@example.org, vaughneric@example.org
Subject: [SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability
 with FORM authentication
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Updated to clarify affected versions as they vary for each affected Realm.

CVE-2009-0580: Tomcat information disclosure vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
MemoryRealm:
 Tomcat 4.1.0 to 4.1.39
 Tomcat 5.5.0 to 5.5.27
 Tomcat 6.0.0 to 6.0.18
DataSourceRealm:
 Tomcat 4.1.17 to 4.1.31
 Tomcat 5.5.0  to 5.5.5
JDBCRealm:
 Tomcat 4.1.0 to 4.1.31
 Tomcat 5.5.0 to 5.5.5

The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.

Description:
Due to insufficient error checking in some authentication classes,
Tomcat allows for the enumeration (brute force testing) of usernames by
supplying illegally URL encoded passwords. The attack is possible if
form based authenticiaton (j_security_check) with one of the following
authentication realms is used:
 * MemoryRealm
 * DataSourceRealm
 * JDBCRealm

Mitigation:
6.0.x users should do one of the following:
 - upgrade to 6.0.20
 - apply this patch http://svn.apache.org/viewvc?rev=747840&view=rev
5.5.x users should do one of the following:
 - upgrade to 5.5.28 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781379&view=rev
4.1.x users should do one of the following:
 - upgrade to 4.1.40 when released
 - apply this patch http://svn.apache.org/viewvc?rev=781382&view=rev

Example:
The following POST request should trigger an error (500 server error or
empty response, depending on the configuration) if the ROOT web
application is configured to use FORM authentication:

POST /j_security_check HTTP/1.1
Host: localhost

j_username=tomcat&j_password=%

Credit:
This issue was discovered by D. Matscheko and T. Hackner of SEC Consult.

References:
http://tomcat.apache.org/security.html

Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkoo/a0ACgkQb7IeiTPGAkOwBgCgg32bOh5/3FWwmg+qnazFuJLy
UGAAnjGl3psau6THn7UDBjpHfSG8LZ4a
=SIJ6
-----END PGP SIGNATURE-----


From announcevaughneric@example.org Mon Jun 08 21:56:05 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 39315 invoked from network); 8 Jun 2009 21:56:04 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 8 Jun 2009 21:56:04 -0000
Received: (qmail 87356 invoked by uid 500); 8 Jun 2009 21:56:16 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 87300 invoked by uid 500); 8 Jun 2009 21:56:16 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 77485 invoked by uid 99); 8 Jun 2009 21:52:59 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (athena.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Mon, 08 Jun 2009 22:52:21 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org, 
 Tomcat Users List <vaughneric@example.org>,
 Tomcat Developers List <vaughneric@example.org>, 
 vaughneric@example.org, vaughneric@example.org
Subject: [SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2008-5515: Apache Tomcat information disclosure vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to 5.5.27
Tomcat 6.0.0 to 6.0.18
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected

Description:
When using a RequestDispatcher obtained from the Request, the target
path was normalised before the query string was removed. A request that
included a specially crafted request parameter could be used to access
content that would otherwise be protected by a security constraint or by
locating it in under the WEB-INF directory.

Mitigation:
6.0.x users should upgrade to 6.0.20 or apply this patch:
http://svn.apache.org/viewvc?view=rev&revision=734734
5.5.x users should upgrade to 5.5.28 when released or apply this patch:
http://svn.apache.org/viewvc?view=rev&revision=782757
4.1.x users should upgrade to 4.1.40 when released or apply this patch:
http://svn.apache.org/viewvc?view=rev&revision=782763

Example:
For a page that contains:
<%
request.getRequestDispatcher( "bar.jsp?somepar=someval&par=" +
    request.getParameter( "blah" ) ).forward( request, response );
%>

an attacker can use:
http://host/page.jsp?blah=/../WEB-INF/web.xml

Credit:
This issue was discovered by Iida Minehiko, Fujitsu Limited

References:
http://tomcat.apache.org/security.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkotiBQACgkQb7IeiTPGAkMi6QCgnlzEt/7byUJo2YXGHMLj2ckH
rF8AoK8dmpZcxd5pV9VvEaPqm4xhXJPO
=bDV5
-----END PGP SIGNATURE-----


From announcevaughneric@example.org Wed Jun 10 11:29:45 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 28910 invoked from network); 10 Jun 2009 11:29:45 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 10 Jun 2009 11:29:45 -0000
Received: (qmail 80422 invoked by uid 500); 10 Jun 2009 11:29:57 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 80373 invoked by uid 500); 10 Jun 2009 11:29:56 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 76407 invoked by uid 99); 10 Jun 2009 11:28:56 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Wed, 10 Jun 2009 12:28:12 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090302)
MIME-Version: 1.0
To: vaughneric@example.org, 
 Tomcat Users List <vaughneric@example.org>,
 Tomcat Developers List <vaughneric@example.org>, 
 vaughneric@example.org, vaughneric@example.org
Subject: [SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal
 vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Updated to add additional patches required for 5.5.x and 4.1.x

CVE-2008-5515: Apache Tomcat information disclosure vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to 5.5.27
Tomcat 6.0.0 to 6.0.18
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected

Description:
When using a RequestDispatcher obtained from the Request, the target
path was normalised before the query string was removed. A request that
included a specially crafted request parameter could be used to access
content that would otherwise be protected by a security constraint or by
locating it in under the WEB-INF directory.

Mitigation:
6.0.x users should upgrade to 6.0.20 or apply this patch:
http://svn.apache.org/viewvc?view=rev&revision=734734
5.5.x users should upgrade to 5.5.28 when released or apply these patches:
http://svn.apache.org/viewvc?view=rev&revision=782757
http://svn.apache.org/viewvc?view=rev&revision=783291
4.1.x users should upgrade to 4.1.40 when released or apply these patches:
http://svn.apache.org/viewvc?view=rev&revision=782763
http://svn.apache.org/viewvc?view=rev&revision=783292

Example:
For a page that contains:
<%
request.getRequestDispatcher( "bar.jsp?somepar=someval&par=" +
    request.getParameter( "blah" ) ).forward( request, response );
%>

an attacker can use:
http://host/page.jsp?blah=/../WEB-INF/web.xml

Credit:
This issue was discovered by Iida Minehiko, Fujitsu Limited

References:
http://tomcat.apache.org/security.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkovmMwACgkQb7IeiTPGAkNPigCcDBEKxwuBoXnvixbqoqM8CIaN
VKYAni4kHySG2JmbYi1hz4xAGpgm36Gr
=7FT9
-----END PGP SIGNATURE-----


From announcevaughneric@example.org Thu Jun 25 23:04:14 2009
Return-Path: <announcevaughneric@example.org>
Delivered-To: vaughneric@example.org
Received: (qmail 79057 invoked from network); 25 Jun 2009 23:04:14 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur.apache.org with SMTP; 25 Jun 2009 23:04:14 -0000
Received: (qmail 55528 invoked by uid 500); 25 Jun 2009 23:04:25 -0000
Delivered-To: vaughneric@example.org
Received: (qmail 55487 invoked by uid 500); 25 Jun 2009 23:04:24 -0000
Mailing-List: contact vaughneric@example.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:vaughneric@example.org>
List-Unsubscribe: <mailto:vaughneric@example.org>
List-Post: <mailto:vaughneric@example.org>
List-Id: <announce.tomcat.apache.org>
Reply-To: vaughneric@example.org
Delivered-To: mailing list vaughneric@example.org
Delivered-To: moderator for vaughneric@example.org
Received: (qmail 12273 invoked by uid 99); 25 Jun 2009 22:17:50 -0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
X-ME-UUID: vaughneric@example.org
X-Virus-Scanned: Debian vaughneric@example.org
Message-ID: <vaughneric@example.org>
Date: Thu, 25 Jun 2009 23:16:55 +0100
From: Mark Thomas <vaughneric@example.org>
User-Agent: Thunderbird 83.161.120.155 (Windows/20090605)
MIME-Version: 1.0
To: Tomcat Users List <vaughneric@example.org>, 
 Tomcat Developers List <vaughneric@example.org>,
 vaughneric@example.org, vaughneric@example.org
Subject: [ANN] Apache Tomcat 4.1.40 stable is now available
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

The Apache Tomcat team is proud to announce the immediate availability
of Tomcat 4.1.40 stable. This build contains a small number of bug fixes
and two important and three low severity security fixes.

Please refer to the release notes for a complete list of changes.

Apache Tomcat 4 is an implementation of the Java Server Pages 1.2 and
Java Servlet 2.3 specifications.

Apache Tomcat 4.1.40 is very likely to be the last release of the 4.1.x
series. Users should be aware that if further security vulnerabilities
are reported in Apache Tomcat, the 4.1.x series will not be reviewed to
determine if the 4.1.x series is affected, neither will a further
release containing a security fix be made for the 4.1.x series. Users
still using the 4.1.x series are strongly encouraged to upgrade to the
latest stable release of the 6.0.x series, 6.0.20.

All Apache Tomcat releases will always be available from the Apache
archives.

Downloads: http://tomcat.apache.org/download-41.cgi

Security information: http://tomcat.apache.org/security-4.html

The Apache Tomcat Team


                     Cryptographic software notice
                     =============================

This distribution includes cryptographic software.  The country in
which you currently reside may have restrictions on the import,
possession, use, and/or re-export to another country, of
encryption software.  BEFORE using any encryption software, please
check your country's laws, regulations and policies concerning the
import, possession, or use, and re-export of encryption software, to
see if this is permitted.  See <http://www.wassenaar.org/> for more
information.

The U.S. Government Department of Commerce, Bureau of Industry and
Security (BIS), has classified this software as Export Commodity
Control Number (ECCN) 5D002.C.1, which includes information security
software using or performing cryptographic functions with asymmetric
algorithms.  The form and manner of this Apache Software Foundation
distribution makes it eligible for export under the License Exception
ENC Technology Software Unrestricted (TSU) exception (see the BIS
Export Administration Regulations, Section 740.13) for both object
code and source code.

The following provides more details on the included cryptographic
software:
  - Tomcat includes code designed to work with JSSE
  - Tomcat includes code designed to work with OpenSSL



{'source': 'Apache Software Foundation Public Mail Archives'}