DSA-225 tomcat4 - source disclosure

Bulletin has no description...

CVE-2002-1895

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service crash via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN...

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the 1 SnoopServlet or 2 TroubleShooter example servlets...

CVE-2002-2008

Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message...

CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages JSP in the 1 test/jsp, 2 samples/jsp and 3 examples/jsp directories, or the 4...

CVE-2002-2009

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

Apache Tomcat MS-DOS Device Name Request DoS

It was possible to freeze or crash Windows or the Apache Tomcat web server by reading thousands of times an MS/DOS device through the Tomcat servlet engine, using a file name like /examples/servlet/AUX. An attacker can exploit this flaw to make your system crash continuously, preventing you from...

tomcat.dos.sh

-----BEGIN PGP SIGNED MESSAGE----- Apache Tomcat: Remote denial-of-service vulnerability 2002-09-06 2002-10-11 Vendor contacted on 2002-09-06. Vendor is verifying the problem since 2002-09-10. No news since then... Microsoft Windows 2000 Microsoft Windows NT may be affected as well. Apache Tomcat...

CVE-2002-0935

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service resource exhaustion via a large number of requests to the server with null characters, which causes the working threads to hang...

Apache Tomcat 3.2 - Directory Disclosure

source: https://www.securityfocus.com/bid/5838/info Apache Tomcat is reported to be prone to a vulnerability which may enable remote attackers to disclose the contents of directories. This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 VVOS systems. It is not known whether other...

Apache Tomcat 3.2 - Directory Disclosure

Apache Tomcat 3.2 - Directory Disclosure source: https://www.securityfocus.com/bid/5838/info Apache Tomcat is reported to be prone to a vulnerability which may enable remote attackers to disclose the contents of directories. This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 VVOS...

Unauthorizaed Apache Tomcat JSP source code disclosure

org.apache.catalina.servlets.DefaultServ let allows to access any JSP code...

Fixed in Apache Tomcat 4.1.12, 4.0.5

Important: Information disclosure CVE-2002-1148 A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages. Affects: 4.0.0-4.0.4, 4.1.0-4.1.11...

Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure

source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data...

Apache Tomcat 34 - DefaultServlet File Disclosure

Apache Tomcat 34 - DefaultServlet File Disclosure source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes...

Apache Tomcat 4.1 Cross-Site Scripting Vulnerability

This writing is part of Malloc Hackers & Malloc Security http://www.malloc.tk http://www.superw00t.com Title: Apache Tomcat 4.1 Cross-Site Scripting Vulnerability Author: Skinnay of Malloc Contact: "Skinnay" - [email protected] No modification of the contents of this file should be made without...

Crossite scripting in Apache Tomcat

It's posible to insert script in request to different servlett classes...

Apache Tomcat 4.1 - JSP Request Cross-Site Scripting

source: https://www.securityfocus.com/bid/5542/info Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache Software Foundation. Tomcat is available for Microsoft Windows, Linux, and other Unix based operating systems. A cross site scripting vulnerability has been reported in some...

Fixed in Apache Tomcat 4.1.29

Moderate: Cross-site scripting CVE-2002-1567 The unmodified requested URL is included in the 404 response header. The new lines in this URL appear to the client to be the end of the header section. The remaining part of the URL, including the script elements, is treated as part of the response bo...

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions...