JVNDB-2009-000010

[Japanese]
JVNDB-2009-000010
Apache Tomcat information disclosure vulnerability
Overview
Apache Tomcat from The Apache Software Foundation contains an information disclosure vulnerability. Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page (JSP) technologies. Apache Tomcat contains a vulnerability which may result in the disclosure of POSTed content from a previous request. This vulnerability was addressed and solved in ASF Bugzilla - Bug 40771. However there was no description regarding this vulnerability in ASF Bugzilla - Bug 40771. Therefore, The Apache Tomcat Development Team has decided to publish an advisory regarding this issue.
CVSS Severity (What is CVSS?)
CVSS V2 Severity: Base Metrics 2.6 (Low) [IPA Score] Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
Affected Products

Apache Software Foundation Apache Tomcat 4.1.32 to 4.1.34 Apache Tomcat 5.5.10 to 5.5.20 FUJITSU Interstage Application Server Interstage Business Application Server Interstage Studio Interstage Web Server

Impact
A remote attacker could possibly obtain user credentials such as password, session ID, user ID, etc. According to the developer, unsupported Apache Tomcat 3.x, 4.0.x, and 5.0.x may also be affected. They have confirmed that Apache Tomcat 6.0.x is not affected.
Solution
[Update the Software] Apply the latest udpate provided by the developer. The following versions contain a fix of this vulnerability. * Apache Tomcat 4.1.35 and later * Apache Tomcat 5.5.21 and later * Apache Tomcat 6.0.0 and later For more information, refer to the developer's website.
Vendor Information
Apache Software Foundation Apache Tomcat : Apache Tomcat 4.x vulnerabilities CVE-2008-4308 Apache Tomcat : Apache Tomcat 5.x vulnerabilities CVE-2008-4308 Apache Tomcat : Security Updates ASF Bugzilla : Bug 40771 FUJITSU FUJITSU Security Information : JVN#66905322 (Japanese) FUJITSU Security Information : interstage-200901
CWE (What is CWE?)
Information Exposure(CWE-200) [IPA Evaluation]
CVE (What is CVE?)
CVE-2008-4308
References
JVN : JVN#66905322 National Vulnerability Database (NVD) : CVE-2008-4308 Secunia Advisory : SA34057 SecurityFocus : 33913 VUPEN Security : VUPEN/ADV-2009-0541 JVN iPedia (Japanese) : JVNDB-2009-000010
Revision History
[2009/02/26] Web page published


Date Public	2009/02/26
Date First Published	2009/02/26
Date Last Updated	2009/02/26

Apache Tomcat information disclosure vulnerability