• info
• discussion
• exploit
• solution
• references

Apache Tomcat Invoker Servlet File Disclosure Vulnerability

Solution:
Fixes are available. Please see the references for details.


Sun Solaris 9

• Sun 113146-11
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -113146-11-1


• Sun 114016-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114016-02-1

Sun Solaris 9_x86

• Sun 114017-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114017-02-1


• Sun 114145-10
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -114145-10-1

Apache Software Foundation Tomcat 4.0

• Apache Software Foundation 13365.zip
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/bin /hotfix/13365.zip

Apache Software Foundation Tomcat 4.0.1

• Apache Software Foundation 13365.zip
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/bin /hotfix/13365.zip

Apache Software Foundation Tomcat 4.0.2

• Apache Software Foundation 13365.zip
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/bin /hotfix/13365.zip

Apache Software Foundation Tomcat 4.0.3

• Apache Software Foundation 13365.zip
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/bin /hotfix/13365.zip


• Debian libtomcat4-java_4.0.3-3woody2_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat4/libtomcat4-j ava_4.0.3-3woody2_all.deb


• Debian tomcat4-webapps_4.0.3-3woody2_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat4/tomcat4-weba pps_4.0.3-3woody2_all.deb


• Debian tomcat4_4.0.3-3woody2_all.deb
  http://security.debian.org/pool/updates/contrib/t/tomcat4/tomcat4_4.0. 3-3woody2_all.deb

Apache Software Foundation Tomcat 4.0.4

• Apache Software Foundation 13365.zip
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/bin /hotfix/13365.zip

Apache Software Foundation Tomcat 4.0.5

• Apache Software Foundation 13365.zip
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/bin /hotfix/13365.zip


• Red Hat tomcat-4.0.6-2.noarch.rpm
  ftp://updates.redhat.com/enterprise/2.1AS/en/SH4.0/noarch/tomcat-4.0.6 -2.noarch.rpm

Apache Software Foundation Tomcat 4.1

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Software Foundation Tomcat 4.1.10

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Software Foundation Tomcat 4.1.3 beta

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/

Apache Software Foundation Tomcat 4.1.9 beta

• Apache Software Foundation Jakarta Tomcat 4.1.12
  http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/