National Vulnerability Database (NVD) National Vulnerability Database (CVE-2009-2902)

National Cyber Awareness System

Vulnerability Summary for CVE-2009-2902

Original release date:01/28/2010

Last revised:03/07/2013

Source: US-CERT/NIST

Overview

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Allows unauthorized modification

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/02/2010)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2902 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ This issue has been addressed in JBoss Enterprise Web Server 1.0.1: https://rhn.redhat.com/errata/RHSA-2010-0119.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: apache-tomcat-war-directory-traversal(55857)

Hyperlink:http://xforce.iss.net/xforce/xfdb/55857

External Source: VUPEN

Name: ADV-2010-1986

Hyperlink:http://www.vupen.com/english/advisories/2010/1986

External Source: VUPEN

Name: ADV-2010-1559

Hyperlink:http://www.vupen.com/english/advisories/2010/1559

External Source: VUPEN

Name: ADV-2010-0213

Hyperlink:http://www.vupen.com/english/advisories/2010/0213

External Source: CONFIRM

Name: http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Hyperlink:http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2011-0003.html

External Source: BID

Name: 37945

Hyperlink:http://www.securityfocus.com/bid/37945

External Source: BUGTRAQ

Name: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded

External Source: BUGTRAQ

Name: 20100124 [SECURITY] CVE-2009-2902 Apache Tomcat unexpected file deletion in work directory

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/509150/100/0/threaded

External Source: REDHAT

Name: RHSA-2010:0582

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0582.html

External Source: REDHAT

Name: RHSA-2010:0580

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0580.html

External Source: REDHAT

Name: RHSA-2010:0119

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0119.html

External Source: MANDRIVA

Name: MDVSA-2010:177

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

External Source: MANDRIVA

Name: MDVSA-2010:176

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

External Source: DEBIAN

Name: DSA-2207

Hyperlink:http://www.debian.org/security/2011/dsa-2207

External Source: UBUNTU

Name: USN-899-1

Hyperlink:http://ubuntu.com/usn/usn-899-1

External Source: CONFIRM

Name: http://tomcat.apache.org/security-6.html

Hyperlink:http://tomcat.apache.org/security-6.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-5.html

Hyperlink:http://tomcat.apache.org/security-5.html

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=902650&view=rev

Hyperlink:http://svn.apache.org/viewvc?rev=902650&view=rev

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=892815&view=rev

Hyperlink:http://svn.apache.org/viewvc?rev=892815&view=rev

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4077

Hyperlink:http://support.apple.com/kb/HT4077

External Source: SECTRACK

Name: 1023504

Hyperlink:http://securitytracker.com/id?1023504

External Source: SECUNIA

Name: 43310

Hyperlink:http://secunia.com/advisories/43310

External Source: SECUNIA

Name: 40813

Hyperlink:http://secunia.com/advisories/40813

External Source: SECUNIA

Name: 40330

Hyperlink:http://secunia.com/advisories/40330

External Source: SECUNIA

Name: 39317

Hyperlink:http://secunia.com/advisories/39317

External Source: SECUNIA

Name: 38687

Hyperlink:http://secunia.com/advisories/38687

External Source: SECUNIA

Name: 38541

Hyperlink:http://secunia.com/advisories/38541

External Source: SECUNIA

Name: 38346

Hyperlink:http://secunia.com/advisories/38346

External Source: SECUNIA

Name: 38316

Type: Advisory

Hyperlink:http://secunia.com/advisories/38316

External Source: OVAL

Name: oval:org.mitre.oval:def:7092

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7092

External Source: SUSE

Name: openSUSE-SU-2013:0147

Hyperlink:http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html

External Source: SUSE

Name: openSUSE-SU-2012:1701

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html

External Source: SUSE

Name: openSUSE-SU-2012:1700

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

External Source: SUSE

Name: SUSE-SR:2010:008

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html

External Source: APPLE

Name: APPLE-SA-2010-03-29-1

Hyperlink:http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

External Source: HP

Name: SSRT100145

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113

External Source: HP

Name: SSRT100145

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113

References to Check Content

Identifier:oval:org.mitre.oval:def:7092

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:7092

Vulnerable software and versions

Configuration 1

* cpe:/a:apache:tomcat:5.5.0

* cpe:/a:apache:tomcat:5.5.25

* cpe:/a:apache:tomcat:5.5.10

* cpe:/a:apache:tomcat:5.5.1

* cpe:/a:apache:tomcat:5.5.28

* cpe:/a:apache:tomcat:5.5.27

* cpe:/a:apache:tomcat:5.5.9

* cpe:/a:apache:tomcat:5.5.8

* cpe:/a:apache:tomcat:5.5.7

* cpe:/a:apache:tomcat:5.5.6

* cpe:/a:apache:tomcat:5.5.5

* cpe:/a:apache:tomcat:5.5.4

* cpe:/a:apache:tomcat:5.5.17

* cpe:/a:apache:tomcat:5.5.18

* cpe:/a:apache:tomcat:5.5.15

* cpe:/a:apache:tomcat:5.5.16

* cpe:/a:apache:tomcat:5.5.13

* cpe:/a:apache:tomcat:5.5.14

* cpe:/a:apache:tomcat:5.5.11

* cpe:/a:apache:tomcat:5.5.12

* cpe:/a:apache:tomcat:5.5.24

* cpe:/a:apache:tomcat:5.5.3

* cpe:/a:apache:tomcat:5.5.22

* cpe:/a:apache:tomcat:5.5.26

* cpe:/a:apache:tomcat:5.5.23

* cpe:/a:apache:tomcat:5.5.20

* cpe:/a:apache:tomcat:5.5.21

* cpe:/a:apache:tomcat:5.5.19

* cpe:/a:apache:tomcat:5.5.2

* cpe:/a:apache:tomcat:6.0.15

* cpe:/a:apache:tomcat:6.0

* cpe:/a:apache:tomcat:6.0.14

* cpe:/a:apache:tomcat:6.0.6

* cpe:/a:apache:tomcat:6.0.7

* cpe:/a:apache:tomcat:6.0.8

* cpe:/a:apache:tomcat:6.0.9

* cpe:/a:apache:tomcat:6.0.17

* cpe:/a:apache:tomcat:6.0.18

* cpe:/a:apache:tomcat:6.0.1

* cpe:/a:apache:tomcat:6.0.0

* cpe:/a:apache:tomcat:6.0.5

* cpe:/a:apache:tomcat:6.0.4

* cpe:/a:apache:tomcat:6.0.3

* cpe:/a:apache:tomcat:6.0.2

* cpe:/a:apache:tomcat:6.0.13

* cpe:/a:apache:tomcat:6.0.12

* cpe:/a:apache:tomcat:6.0.11

* cpe:/a:apache:tomcat:6.0.10

* cpe:/a:apache:tomcat:6.0.16

* cpe:/a:apache:tomcat:6.0.19

* cpe:/a:apache:tomcat:6.0.20

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Path Traversal (CWE-22)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2902