National Vulnerability Database (NVD) National Vulnerability Database (CVE-2009-2693)

National Cyber Awareness System

Vulnerability Summary for CVE-2009-2693

Original release date:01/28/2010

Last revised:03/07/2013

Source: US-CERT/NIST

Overview

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:P) (legend)

Impact Subscore: 4.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Allows unauthorized modification; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/02/2010)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2693 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ This issue has been addressed in JBoss Enterprise Web Server 1.0.1: https://rhn.redhat.com/errata/RHSA-2010-0119.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2010-0213

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2010/0213

External Source: CONFIRM

Name: http://tomcat.apache.org/security-6.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-6.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-5.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-5.html

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=892815&view=rev

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?rev=892815&view=rev

External Source: XF

Name: tomcat-war-directory-traversal(55855)

Hyperlink:http://xforce.iss.net/xforce/xfdb/55855

External Source: VUPEN

Name: ADV-2010-1986

Hyperlink:http://www.vupen.com/english/advisories/2010/1986

External Source: VUPEN

Name: ADV-2010-1559

Hyperlink:http://www.vupen.com/english/advisories/2010/1559

External Source: CONFIRM

Name: http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Hyperlink:http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2011-0003.html

External Source: BID

Name: 37944

Hyperlink:http://www.securityfocus.com/bid/37944

External Source: BUGTRAQ

Name: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded

External Source: BUGTRAQ

Name: 20100124 [SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/509148/100/0/threaded

External Source: REDHAT

Name: RHSA-2010:0582

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0582.html

External Source: REDHAT

Name: RHSA-2010:0580

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0580.html

External Source: REDHAT

Name: RHSA-2010:0119

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0119.html

External Source: MANDRIVA

Name: MDVSA-2010:177

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

External Source: MANDRIVA

Name: MDVSA-2010:176

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

External Source: DEBIAN

Name: DSA-2207

Hyperlink:http://www.debian.org/security/2011/dsa-2207

External Source: UBUNTU

Name: USN-899-1

Hyperlink:http://ubuntu.com/usn/usn-899-1

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=902650&view=rev

Hyperlink:http://svn.apache.org/viewvc?rev=902650&view=rev

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4077

Hyperlink:http://support.apple.com/kb/HT4077

External Source: SECTRACK

Name: 1023505

Hyperlink:http://securitytracker.com/id?1023505

External Source: SECUNIA

Name: 43310

Hyperlink:http://secunia.com/advisories/43310

External Source: SECUNIA

Name: 40813

Hyperlink:http://secunia.com/advisories/40813

External Source: SECUNIA

Name: 40330

Hyperlink:http://secunia.com/advisories/40330

External Source: SECUNIA

Name: 39317

Hyperlink:http://secunia.com/advisories/39317

External Source: SECUNIA

Name: 38687

Hyperlink:http://secunia.com/advisories/38687

External Source: SECUNIA

Name: 38541

Hyperlink:http://secunia.com/advisories/38541

External Source: SECUNIA

Name: 38346

Type: Advisory

Hyperlink:http://secunia.com/advisories/38346

External Source: SECUNIA

Name: 38316

Type: Advisory

Hyperlink:http://secunia.com/advisories/38316

External Source: OVAL

Name: oval:org.mitre.oval:def:7017

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7017

External Source: SUSE

Name: openSUSE-SU-2013:0147

Hyperlink:http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html

External Source: SUSE

Name: openSUSE-SU-2012:1701

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html

External Source: SUSE

Name: openSUSE-SU-2012:1700

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

External Source: SUSE

Name: SUSE-SR:2010:008

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html

External Source: APPLE

Name: APPLE-SA-2010-03-29-1

Hyperlink:http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

External Source: HP

Name: SSRT100145

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113

External Source: HP

Name: SSRT100145

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113

References to Check Content

Identifier:oval:org.mitre.oval:def:7017

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:7017

Vulnerable software and versions

Configuration 1

* cpe:/a:apache:tomcat:5.5.0

* cpe:/a:apache:tomcat:5.5.25

* cpe:/a:apache:tomcat:5.5.10

* cpe:/a:apache:tomcat:5.5.1

* cpe:/a:apache:tomcat:5.5.28

* cpe:/a:apache:tomcat:5.5.27

* cpe:/a:apache:tomcat:5.5.9

* cpe:/a:apache:tomcat:5.5.8

* cpe:/a:apache:tomcat:5.5.7

* cpe:/a:apache:tomcat:5.5.6

* cpe:/a:apache:tomcat:5.5.5

* cpe:/a:apache:tomcat:5.5.4

* cpe:/a:apache:tomcat:5.5.17

* cpe:/a:apache:tomcat:5.5.18

* cpe:/a:apache:tomcat:5.5.15

* cpe:/a:apache:tomcat:5.5.16

* cpe:/a:apache:tomcat:5.5.13

* cpe:/a:apache:tomcat:5.5.14

* cpe:/a:apache:tomcat:5.5.11

* cpe:/a:apache:tomcat:5.5.12

* cpe:/a:apache:tomcat:5.5.24

* cpe:/a:apache:tomcat:5.5.3

* cpe:/a:apache:tomcat:5.5.22

* cpe:/a:apache:tomcat:5.5.26

* cpe:/a:apache:tomcat:5.5.23

* cpe:/a:apache:tomcat:5.5.20

* cpe:/a:apache:tomcat:5.5.21

* cpe:/a:apache:tomcat:5.5.19

* cpe:/a:apache:tomcat:5.5.2

* cpe:/a:apache:tomcat:6.0.15

* cpe:/a:apache:tomcat:6.0

* cpe:/a:apache:tomcat:6.0.14

* cpe:/a:apache:tomcat:6.0.6

* cpe:/a:apache:tomcat:6.0.7

* cpe:/a:apache:tomcat:6.0.8

* cpe:/a:apache:tomcat:6.0.9

* cpe:/a:apache:tomcat:6.0.17

* cpe:/a:apache:tomcat:6.0.18

* cpe:/a:apache:tomcat:6.0.1

* cpe:/a:apache:tomcat:6.0.0

* cpe:/a:apache:tomcat:6.0.5

* cpe:/a:apache:tomcat:6.0.4

* cpe:/a:apache:tomcat:6.0.3

* cpe:/a:apache:tomcat:6.0.2

* cpe:/a:apache:tomcat:6.0.13

* cpe:/a:apache:tomcat:6.0.12

* cpe:/a:apache:tomcat:6.0.11

* cpe:/a:apache:tomcat:6.0.10

* cpe:/a:apache:tomcat:6.0.16

* cpe:/a:apache:tomcat:6.0.19

* cpe:/a:apache:tomcat:6.0.20

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Path Traversal (CWE-22)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693