Severity: : Medium
  CVE Kennungen: : CVE-2008-2370
  Advisory Date: 21 lipca 2015

  DESCRIPTION

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

  INFORMATION EXPOSURE

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1002688
  Trend Micro Deep Security DPI Rule Name: 1002688 - Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

  AFFECTED SOFTWARE AND VERSION:

  • Apache Tomcat 6.0.9
  • Apache Tomcat 6.0.15
  • Apache Tomcat 6.0.17
  • Apache Tomcat 5.5.26
  • Apache Tomcat 5.5.25
  • Apache Tomcat 5.5.24
  • Apache Tomcat 5.5.23
  • Apache Tomcat 5.5.15
  • Apache Tomcat 4.1.9
  • Apache Tomcat 4.1.6
  • Apache Tomcat 4.1.5
  • Apache Tomcat 4.1.4
  • Apache Tomcat 4.1.37
  • Apache Tomcat 4.1.35
  • Apache Tomcat 4.1.34
  • Apache Tomcat 4.1.33
  • Apache Tomcat 4.1.32
  • Apache Tomcat 4.1.31
  • Apache Tomcat 4.1.30
  • Apache Tomcat 4.1.3
  • Apache Tomcat 4.1.29
  • Apache Tomcat 4.1.28
  • Apache Tomcat 4.1.27
  • Apache Tomcat 4.1.26
  • Apache Tomcat 4.1.25
  • Apache Tomcat 4.1.24
  • Apache Tomcat 4.1.23
  • Apache Tomcat 4.1.22
  • Apache Tomcat 4.1.21
  • Apache Tomcat 4.1.2
  • Apache Tomcat 4.1.19
  • Apache Tomcat 4.1.18
  • Apache Tomcat 4.1.17
  • Apache Tomcat 4.1.15
  • Apache Tomcat 4.1.14
  • Apache Tomcat 4.1.13
  • Apache Tomcat 4.1.12
  • Apache Tomcat 4.1.11
  • Apache Tomcat 4.1.10
  • Apache Tomcat 4.1.1
  • Apache Tomcat 4.1.0