AOH :: HP Unsorted X :: VA2791.HTM

Apache Tomcat examples web application XSS



CVE-2009-0781 XSS in Apache Tomcat examples web application
CVE-2009-0781 XSS in Apache Tomcat examples web application



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability

Severity: low

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39

Description:
The calendar application in the examples contains invalid HTML which
renders the XSS protection for the time parameter ineffective. An
attacker can therefore perform an XSS attack using the time attribute.

Mitigation:
6.0.x users should do one of the following:
 - remove the examples web application
- apply this patch http://svn.apache.org/viewvc?rev=750924&view=rev 
 - upgrade to 6.0.19 when released
5.5.x users should do one of the following:
 - remove the examples web application
- apply this patch http://svn.apache.org/viewvc?rev=750928&view=rev 
 - upgrade to 5.5.28 when released
4.1.x users should do one of the following:
 - remove the examples web application
- apply this patch http://svn.apache.org/viewvc?rev=750927&view=rev 
 - upgrade to 4.1.40 when released

Example:
http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS')}); 

Credit:
This issue was discovered by Deniz Cevik.

References:
http://tomcat.apache.org/security.html 
http://tomcat.apache.org/security-6.html 
http://tomcat.apache.org/security-5.html 
http://tomcat.apache.org/security-4.html 

The Apache Tomcat Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org 

iD8DBQFJsUexb7IeiTPGAkMRAnQkAKDSvIKgXQTCEOdYo0T1Ms0ze07qWQCgh2Af
7M0rD3B+d5vu90/ode27FLI=Y8kB
-----END PGP SIGNATURE-----


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.