Tomcat vulnerabilities

2010-02-1100:00:00

ubuntu.com

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

AI Score

4.5

Confidence

High

EPSS

0.005

Percentile

76.4%

JSON

Releases

Ubuntu 9.10
Ubuntu 9.04
Ubuntu 8.10

Packages

tomcat6 -

Details

It was discovered that Tomcat did not correctly validate WAR filenames or
paths when deploying. A remote attacker could send a specially crafted WAR
file to be deployed and cause arbitrary files and directories to be
created, overwritten, or deleted.

OSVersionArchitecturePackageVersionFilename
Ubuntu9.10noarchlibtomcat6-java< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchlibservlet2.5-java< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchlibservlet2.5-java-doc< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchtomcat6< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchtomcat6-admin< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchtomcat6-common< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchtomcat6-docs< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchtomcat6-examples< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchtomcat6-user< 6.0.20-2ubuntu2.1UNKNOWN
Ubuntu9.04noarchlibtomcat6-java< 6.0.18-0ubuntu6.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.10	noarch	libtomcat6-java	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	libservlet2.5-java	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	libservlet2.5-java-doc	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	tomcat6	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	tomcat6-admin	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	tomcat6-common	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	tomcat6-docs	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	tomcat6-examples	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	tomcat6-user	< 6.0.20-2ubuntu2.1	UNKNOWN
Ubuntu	9.04	noarch	libtomcat6-java	< 6.0.18-0ubuntu6.2	UNKNOWN