Apache Tomcat Cross Site Scripting

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability  
  
Severity: low  
  
Vendor:  
The Apache Software Foundation  
  
Versions Affected:  
Tomcat 6.0.0 to 6.0.18  
Tomcat 5.5.0 to 5.5.27  
Tomcat 4.1.0 to 4.1.39  
  
Description:  
The calendar application in the examples contains invalid HTML which  
renders the XSS protection for the time parameter ineffective. An  
attacker can therefore perform an XSS attack using the time attribute.  
  
Mitigation:  
6.0.x users should do one of the following:  
- remove the examples web application  
- apply this patch http://svn.apache.org/viewvc?rev=750924&view=rev  
- upgrade to 6.0.19 when released  
5.5.x users should do one of the following:  
- remove the examples web application  
- apply this patch http://svn.apache.org/viewvc?rev=750928&view=rev  
- upgrade to 5.5.28 when released  
4.1.x users should do one of the following:  
- remove the examples web application  
- apply this patch http://svn.apache.org/viewvc?rev=750927&view=rev  
- upgrade to 4.1.40 when released  
  
Example:  
http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS')});  
  
Credit:  
This issue was discovered by Deniz Cevik.  
  
References:  
http://tomcat.apache.org/security.html  
http://tomcat.apache.org/security-6.html  
http://tomcat.apache.org/security-5.html  
http://tomcat.apache.org/security-4.html  
  
The Apache Tomcat Security Team  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.7 (MingW32)  
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org  
  
iD8DBQFJsUexb7IeiTPGAkMRAnQkAKDSvIKgXQTCEOdYo0T1Ms0ze07qWQCgh2Af  
7M0rD3B+d5vu90/ode27FLI=  
=Y8kB  
-----END PGP SIGNATURE-----  
`