Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: General :: glsato1.txt

Tomcat source disclosure

- - --------------------------------------------------------------------
- - --------------------------------------------------------------------

PACKAGE : tomcat
SUMMARY : source disclosure
EXPLOIT : remote
DATE    : 2002-10-15 08:15 UTC

- - --------------------------------------------------------------------

A security vulnerability has been confirmed to exist in Apache Tomcat
4.0.x releases (including Tomcat 4.0.5), which allows to use a specially
crafted URL to return the unprocessed source of a JSP page, or, under
special circumstances, a static resource which would otherwise have been
protected by security constraint, without the need for being properly
authenticated. This is based on a variant of the exploit that was
disclosed on 09/24/2002.

Read the full disclosure at


It is recommended that all Gentoo Linux users who are running
net-www/tomcat-4.0.5 and earlier update their systems
as follows:

emerge rsync
emerge tomcat
emerge clean

- - -------------------------------------------------------------------- - GnuPG key is available at
- - --------------------------------------------------------------------

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH