• info
• discussion
• exploit
• solution
• references

Apache Tomcat SecurityManager Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu libservlet2.5-java-doc_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.24-2ubuntu1.7_all.deb


• Ubuntu libservlet2.5-java_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.24-2ubuntu1.7_all.deb


• Ubuntu libtomcat6-java_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.24-2ubuntu1.7_all.deb


• Ubuntu tomcat6-admin_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.24-2ubuntu1.7_all.deb


• Ubuntu tomcat6-common_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.24-2ubuntu1.7_all.deb


• Ubuntu tomcat6-docs_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .24-2ubuntu1.7_all.deb


• Ubuntu tomcat6-examples_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.24-2ubuntu1.7_all.deb


• Ubuntu tomcat6-user_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .24-2ubuntu1.7_all.deb


• Ubuntu tomcat6_6.0.24-2ubuntu1.7_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.24-2 ubuntu1.7_all.deb

Ubuntu Ubuntu Linux 9.10 ARM

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libservlet2.5-java-doc_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libservlet2.5-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.20-2ubuntu2.4_all.deb


• Ubuntu libtomcat6-java_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-admin_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-common_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-docs_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-examples_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.20-2ubuntu2.4_all.deb


• Ubuntu tomcat6-user_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .20-2ubuntu2.4_all.deb


• Ubuntu tomcat6_6.0.20-2ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.20-2 ubuntu2.4_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva tomcat5-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva tomcat5-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.4mdvmes5.1.noarch.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva tomcat5-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-admin-webapps-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-common-lib-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-eclipse-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jasper-javadoc-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-jsp-2.0-api-javadoc-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-server-lib-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-servlet-2.4-api-javadoc-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva tomcat5-webapps-5.5.27-0.3.0.4mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.10 powerpc

• Ubuntu libservlet2.5-java-doc_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va-doc_6.0.28-2ubuntu1.2_all.deb


• Ubuntu libservlet2.5-java_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libservlet2.5-ja va_6.0.28-2ubuntu1.2_all.deb


• Ubuntu libtomcat6-java_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/libtomcat6-java_ 6.0.28-2ubuntu1.2_all.deb


• Ubuntu tomcat6-admin_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-admin_6. 0.28-2ubuntu1.2_all.deb


• Ubuntu tomcat6-common_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-common_6 .0.28-2ubuntu1.2_all.deb


• Ubuntu tomcat6-docs_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-docs_6.0 .28-2ubuntu1.2_all.deb


• Ubuntu tomcat6-examples_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-examples _6.0.28-2ubuntu1.2_all.deb


• Ubuntu tomcat6-user_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6-user_6.0 .28-2ubuntu1.2_all.deb


• Ubuntu tomcat6_6.0.28-2ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/t/tomcat6/tomcat6_6.0.28-2 ubuntu1.2_all.deb