Apache Tomcat UTF-8目录遍历漏洞

BUGTRAQ ID:30633
CVE ID：CVE-2008-2938
CNCVE ID：CNCVE-20082938

Apache Tomcat是一款流行的开放源码的JSP应用服务器程序。。
Apache Tomcat不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB服务程序上下文查看任意本地文件。
此漏洞发生是由于JAVA处理输入存在问题，如果context.xml或server.xml允许’allowLinking’和’URIencoding’为’UTF-8’，攻击者可以以WEB权限获得重要的系统文件内容。

Apache Software Foundation Tomcat 6.0.16
Apache Software Foundation Tomcat 6.0.15
Apache Software Foundation Tomcat 6.0.14
Apache Software Foundation Tomcat 6.0.13
Apache Software Foundation Tomcat 6.0.12
Apache Software Foundation Tomcat 6.0.11
Apache Software Foundation Tomcat 6.0.10
Apache Software Foundation Tomcat 6.0.9
Apache Software Foundation Tomcat 6.0.8
Apache Software Foundation Tomcat 6.0.7
Apache Software Foundation Tomcat 6.0.6
Apache Software Foundation Tomcat 6.0.5
Apache Software Foundation Tomcat 6.0.4
Apache Software Foundation Tomcat 6.0.3
Apache Software Foundation Tomcat 6.0.2
Apache Software Foundation Tomcat 6.0.1
Apache Software Foundation Tomcat 6.0
Apache Software Foundation Tomcat 5.5.26
Apache Software Foundation Tomcat 5.5.25
Apache Software Foundation Tomcat 5.5.24
Apache Software Foundation Tomcat 5.5.23
Apache Software Foundation Tomcat 5.5.22
Apache Software Foundation Tomcat 5.5.21
Apache Software Foundation Tomcat 5.5.20
Apache Software Foundation Tomcat 5.5.19
Apache Software Foundation Tomcat 5.5.18
Apache Software Foundation Tomcat 5.5.17
Apache Software Foundation Tomcat 5.5.16
Apache Software Foundation Tomcat 5.5.15
Apache Software Foundation Tomcat 5.5.14
Apache Software Foundation Tomcat 5.5.13
Apache Software Foundation Tomcat 5.5.12
Apache Software Foundation Tomcat 5.5.11
Apache Software Foundation Tomcat 5.5.10
Apache Software Foundation Tomcat 5.5.9
Apache Software Foundation Tomcat 5.5.8
Apache Software Foundation Tomcat 5.5.7
Apache Software Foundation Tomcat 5.5.6
Apache Software Foundation Tomcat 5.5.5
Apache Software Foundation Tomcat 5.5.4
Apache Software Foundation Tomcat 5.5.3
Apache Software Foundation Tomcat 5.5.2
Apache Software Foundation Tomcat 5.5.1
Apache Software Foundation Tomcat 5.5
Apache Software Foundation Tomcat 4.1.37
Apache Software Foundation Tomcat 4.1.36
Apache Software Foundation Tomcat 4.1.36
Apache Software Foundation Tomcat 4.1.34
Apache Software Foundation Tomcat 4.1.34

• Gentoo Linux 1.4 _rc3
• Gentoo Linux 1.4 _rc2
• Gentoo Linux 1.4 _rc1
• Gentoo Linux 1.2
  Apache Software Foundation Tomcat 4.1.32
  Apache Software Foundation Tomcat 4.1.31
  Apache Software Foundation Tomcat 4.1.30
  Apache Software Foundation Tomcat 4.1.29
  Apache Software Foundation Tomcat 4.1.28
  Apache Software Foundation Tomcat 4.1.24
• Gentoo Linux 1.4 _rc3
• Gentoo Linux 1.4 _rc2
• Gentoo Linux 1.4 _rc1
• Gentoo Linux 1.2
  Apache Software Foundation Tomcat 4.1.12
  Apache Software Foundation Tomcat 4.1.10
  Apache Software Foundation Tomcat 4.1.9 beta
  Apache Software Foundation Tomcat 4.1.3 beta
  Apache Software Foundation Tomcat 4.1.3
  Apache Software Foundation Tomcat 4.1
  升级到最新版本6.0.18：
  <a href=“http://tomcat.apache.org” target=“_blank”>http://tomcat.apache.org</a>
  临时解决方案为：
  禁用allowLinking或不要设置URIencoding为UTF8。