exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 68 RSS Feed

Files from Mark Thomas

Email addressmarkt at apache.org
First Active2007-05-22
Last Active2017-04-10
Apache Tomcat 7.x / 8.x / 9.x Information Disclosure
Posted Apr 10, 2017
Authored by Mark Thomas | Site tomcat.apache.org

While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. Apache Tomcat versions 7.0.0 through 7.0.75, 8.0.0.RC1 through 8.0.41, 8.5.0 through 8.5.11, and 9.0.0.M1 through 9.0.0.M17 are affected.

tags | advisory, web
advisories | CVE-2017-5648
SHA-256 | 193ab6114148905ba8825ba1b184c06507caac43be27d616db0d37daee7cc903
Apache Tomcat 8.x / 9.x Refactoring Information Disclosure
Posted Apr 10, 2017
Authored by Mark Thomas | Site tomcat.apache.org

The refactoring of the HTTP connectors for 8.5.x onwards, introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up. Apache Tomcat versions 8.5.0 through 8.5.12 and 9.0.0.M1 through 9.0.0.M18 are affected.

tags | advisory, web
advisories | CVE-2017-5651
SHA-256 | 9e9a2ed68a0484d3c5eedcf6b96e3c1f556c0d256bfd0937b7b5acc81297e9ef
Apache Tomcat 9.0.0.M13 / 8.5.8 Information Disclosure
Posted Dec 12, 2016
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat versions 9.0.0.M1 to 9.0.0.M13 and 8.5.0 to 8.5.8 suffer from an information disclosure vulnerability.

tags | advisory, info disclosure
advisories | CVE-2016-8745
SHA-256 | 87374b922774cdd9500485f33643f484d8f82656445505c941b1905db8a17768
Apache Tomcat JK ISAPI Connector 1.2.41 Buffer Overflow
Posted Oct 11, 2016
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat JK ISAPI Connector versions 1.2.0 through 1.2.41 suffer from a buffer overflow vulnerability.

tags | advisory, overflow
advisories | CVE-2016-6808
SHA-256 | af3e2192d229265af6b020a6c9364f60ab9600ec86a04efb358cb0d02c2df87a
Apache Tomcat Security Manager Bypass
Posted Feb 23, 2016
Authored by Mark Thomas | Site tomcat.apache.org

ResourceLinkFactory.setGlobalContext() is a public method and was accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web applications and/or read and write data owned by other web applications. Apache Tomcat versions 7.0.0 through 7.0.67, 8.0.0.RC1 through 8.0.30, and 9.0.0.M1 through 9.0.0.M2 are affected.

tags | advisory, web
advisories | CVE-2016-0763
SHA-256 | ac830c66f4618379f15b9c52065d4800a58e4532b36aa5e987cfc5a7dea7eb16
Apache Tomcat Directory Disclosure
Posted Feb 23, 2016
Authored by Mark Thomas | Site tomcat.apache.org

When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was therefore possible for a user to determine if a directory existed or not, even if the user was not permitted to view the directory. The issue also occurred at the root of a web application in which case the presence of the web application was confirmed, even if a user did not have access. Apache Tomcat versions 6.0.0 through 6.0.44, 7.0.0 through 7.0.65, and 8.0.0.RC1 through 8.0.29.

tags | advisory, web, root
advisories | CVE-2015-5345
SHA-256 | f43d6dbb774b4dfc48b17b117d3cde0c12a7d82fc18efc497696311d683c01f8
Apache Tomcat Limited Directory Traversal
Posted Feb 22, 2016
Authored by Mark Thomas | Site tomcat.apache.org

When accessing resources via the ServletContext methods getResource() getResourceAsStream() and getResourcePaths() the paths should be limited to the current web application. The validation was not correct and paths of the form "/.." were not rejected. Note that paths starting with "/../" were correctly rejected. Apache Tomcat versions 6.0.0 through 6.0.44, 7.0.0 through 7.0.64, and 8.0.0.RC1 through 8.0.26.

tags | advisory, web
advisories | CVE-2015-5174
SHA-256 | b1f753e54e5215e5b5e3807834777c09565ba6a20e0a2b3c9fb5433a181e671a
Apache Tomcat CSRF Token Leak
Posted Feb 22, 2016
Authored by Mark Thomas | Site tomcat.apache.org

The index page of the Manager and Host Manager applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to construct a CSRF attack. Apache Tomcat versions 7.0.1 through 7.0.67, 8.0.0.RC1 through 8.0.31, and 9.0.0.M1 are affected.

tags | advisory, web, root
advisories | CVE-2015-5351
SHA-256 | cac499db9a90243eb7e3a3ae64996e75bfc026156676e4f5e2b513a78ec60214
Apache Tomcat Security Manager StatusManagerServlet Bypass
Posted Feb 22, 2016
Authored by Mark Thomas | Site tomcat.apache.org

The StatusManagerServlet could be loaded by a web application when a security manager was configured. This servlet would then provide the web application with a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. This could have exposed sensitive information from other web applications such as session IDs to the web application. Apache Tomcat versions 6.0.0 through 6.0.44, 7.0.0 through 7.0.67, 8.0.0.RC1 through 8.0.30, and 9.0.0.M1 are affected.

tags | advisory, web
advisories | CVE-2016-0706
SHA-256 | 881ae95f3222d34f23b6f66acf5f6fe6bc505df9c7afff2901307b8b3b3a741f
Apache Tomcat Session Fixation
Posted Feb 22, 2016
Authored by Mark Thomas | Site tomcat.apache.org

When recycling the Request object to use for a new request, the requestedSessionSSL field was not recycled. This meant that a session ID provided in the next request to be processed using the recycled Request object could be used when it should not have been. This gave the client the ability to control the session ID. In theory, this could have been used as part of a session fixation attack but it would have been hard to achieve as the attacker would not have been able to force the victim to use the 'correct' Request object. It was also necessary for at least one web application to be configured to use the SSL session ID as the HTTP session ID. This is not a common configuration. Apache Tomcat versions 7.0.5 through 7.0.65, 8.0.0.RC1 through 8.0.30, and 9.0.0.M1 are affected.

tags | advisory, web
advisories | CVE-2015-5346
SHA-256 | f04a5470641204db89ec17e9b80c496ffce8bd8aae7f2efd4bc0229158a89b21
Apache Tomcat Security Manager Persistence Bypass
Posted Feb 22, 2016
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat provides several session persistence mechanisms. The StandardManager persists session over a restart. The PersistentManager is able to persist sessions to files, a database or a custom Store. The Cluster implementation persists sessions to one or more additional nodes in the cluster. All of these mechanisms could be exploited to bypass a security manager. Session persistence is performed by Tomcat code with the permissions assigned to Tomcat internal code. By placing a carefully crafted object into a session, a malicious web application could trigger the execution of arbitrary code. Apache Tomcat versions 6.0.0 through 6.0.44, 7.0.0 through 7.0.67, 8.0.0.RC1 through 8.0.30, and 9.0.0.M1 are affected.

tags | advisory, web, arbitrary
advisories | CVE-2016-0714
SHA-256 | d8b973e72649ee49a60e92929010021e4dfc8736401a1288bdb928d8309d8597
Apache Tomcat Security Manager Bypass
Posted May 14, 2015
Authored by Mark Thomas | Site tomcat.apache.org

Malicious web applications could use expression language to bypass the protections of a Security Manager as expressions were evaluated within a privileged code section. This issue only affects installations that run web applications from untrusted sources. Apache Tomcat versions 8.0.0-RC1 to 8.0.15, 7.0.0 to 7.0.57, and 6.0.0 to 6.0.43 are affected.

tags | advisory, web, bypass
advisories | CVE-2014-7810
SHA-256 | ae7ea53034ada919480d439f340f0f86e63c7361e273e4d38ea3034409f7672b
Apache Tomcat 7.0.39 Remote Code Execution
Posted Sep 10, 2014
Authored by Mark Thomas, Pierre Ernst | Site tomcat.apache.org

In very limited circumstances, it was possible for an attacker to upload a malicious JSP to a Tomcat server and then trigger the execution of that JSP. While Remote Code Execution would normally be viewed as a critical vulnerability, the circumstances under which this is possible are, in the view of the Tomcat security team, sufficiently limited that this vulnerability is viewed as important. Apache Tomcat versions 7.0.0 through 7.0.39 are affected.

tags | advisory, remote, code execution
advisories | CVE-2013-4444
SHA-256 | b2ea73c8b10cd079ee3352350d5c7fa19457771401cedd12bbf9a02e13493849
Apache Tomcat XML Parser Information Disclosure
Posted May 30, 2014
Authored by Mark Thomas | Site tomcat.apache.org

In limited circumstances it was possible for a malicious web application to replace the XML parsers used by Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs) and tag plugin configuration files. The injected XMl parser(s) could then bypass the limits imposed on XML external entities and/or have visibility of the XML files processed for other web applications deployed on the same Tomcat instance. Versions affected include Apache Tomcat 8.0.0-RC1 to 8.0.5, Apache Tomcat 7.0.0 to 7.0.53, and Apache Tomcat 6.0.0 to 6.0.39.

tags | advisory, web, xxe
advisories | CVE-2014-0119
SHA-256 | b71018c17fe31cadd9009eec7e6aa8baac5fe8224526001717dfff63d30296e6
Apache Tomcat XSLT Information Disclosure
Posted May 30, 2014
Authored by Mark Thomas | Site tomcat.apache.org

The default servlet allows web applications to define (at multiple levels) an XSLT to be used to format a directory listing. When running under a security manager, the processing of these was not subject to the same constraints as the web application. This enabled a malicious web application to bypass the file access constraints imposed by the security manager via the use of external XML entities. Versions affected include Apache Tomcat 8.0.0-RC1 to 8.0.3, Apache Tomcat 7.0.0 to 7.0.52, and Apache Tomcat 6.0.0 to 6.0.39.

tags | advisory, web
advisories | CVE-2014-0096
SHA-256 | 10f8569b889be3e5065679485f9df35a245480080081a0d21ce4014edf7c0b4a
Apache Tomcat Information Disclosure
Posted May 29, 2014
Authored by Mark Thomas | Site tomcat.apache.org

The code used to parse the request content length header did not check for overflow in the result. This exposed a request smuggling vulnerability when Tomcat was located behind a reverse proxy that correctly processed the content length header. Versions affected include Apache Tomcat 8.0.0-RC1 to 8.0.3, Apache Tomcat 7.0.0 to 7.0.52, and Apache Tomcat 6.0.0 to 6.0.39.

tags | advisory, overflow
advisories | CVE-2014-0099
SHA-256 | efe876f026d805aec0ae402905d0f399166b1e85133b042ab6011a6439d5095f
Apache Tomcat Denial Of Service
Posted May 29, 2014
Authored by Mark Thomas | Site tomcat.apache.org

It was possible to craft a malformed chunk size as part of a chucked request that enabled an unlimited amount of data to be streamed to the server, bypassing the various size limits enforced on a request. This enabled a denial of service attack. Versions affected include Apache Tomcat 8.0.0-RC1 to 8.0.3, Apache Tomcat 7.0.0 to 7.0.52, and Apache Tomcat 6.0.0 to 6.0.39.

tags | advisory, denial of service
advisories | CVE-2014-0075
SHA-256 | 14014726ae194fcbd52254b00f5e7e99823908207f8227e73309d1f9549f50e1
Apache Tomcat Denial Of Service
Posted May 29, 2014
Authored by Mark Thomas | Site tomcat.apache.org

A regression was introduced in revision 1519838 that caused AJP requests to hang if an explicit content length of zero was set on the request. The hanging request consumed a request processing thread which could lead to a denial of service. Versions affected include Apache Tomcat 8.0.0-RC2 to 8.0.3.

tags | advisory, denial of service
advisories | CVE-2014-0095
SHA-256 | 28c61c41ea4c82aebf18e1389e65f0ee95408b53ccd619f2378c0bef49785f6a
Apache Struts ClassLoader Manipulation Remote Code Execution
Posted May 2, 2014
Authored by Mark Thomas, Przemyslaw Celej | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Apache Struts versions < 2.3.16.2. This issue is caused because the ParametersInterceptor allows access to 'class' parameter which is directly mapped to getClass() method and allows ClassLoader manipulation, which allows remote attackers to execute arbitrary Java code via crafted parameters.

tags | exploit, java, remote, arbitrary
advisories | CVE-2014-0094, CVE-2014-0112
SHA-256 | 568fa33a2e2d5a30bbf04a28ef0440ffb1ef8efbbd4f569d313ce10a93ef7a01
Apache Tomcat Information Disclosure Via XXE
Posted Feb 26, 2014
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat versions 8.0.0-RC1 through 8.0.0-RC5, 7.0.0 through 7.0.47, and 6.0.0 through 6.0.37 suffer from an information disclosure vulnerability via XXE when running untrusted web applications.

tags | advisory, web, info disclosure, xxe
advisories | CVE-2013-4590
SHA-256 | e5038c902c4a597115e468b2cd9304969026597458d6fd3280891c6e2c2d59df
Apache Tomcat Denial Of Service
Posted Feb 26, 2014
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat versions 8.0.0-RC1 through 8.0.0-RC5, 7.0.0 through 7.0.47, and 6.0.0 through 6.0.37 suffer from a denial of service vulnerability due to an incomplete fix for CVE-2012-3544.

tags | advisory, denial of service
advisories | CVE-2012-3544, CVE-2013-4322
SHA-256 | 8ac3ea938f07d2896bed13e92312af0a063d45b0633a23f122e4629acf2c3085
Apache Tomcat Session Fixation
Posted Feb 25, 2014
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat versions 6.0.33 through 6.0.37 suffer from a session fixation vulnerability.

tags | advisory
advisories | CVE-2014-0033
SHA-256 | 36ba52ce6c47d3e65da9ef3538ecc03acfbac6781df236369fa3d9cf1cbe32e3
Apache Tomcat Information Disclosure
Posted Feb 25, 2014
Authored by Mark Thomas | Site tomcat.apache.org

Apache Tomcat versions 8.0.0-RC1, 7.0.0 through 7.0.42, and 6.0.0 through 6.0.37 suffer from an information disclosure vulnerability due to an incomplete fix for CVE-2005-2090.

tags | advisory, info disclosure
advisories | CVE-2005-2090, CVE-2013-4286
SHA-256 | 85aca72a0ab50801bdc11f8b35cd76f7c8566b582f96d36c721332941fd2bdcc
Apache Commons FileUpload / Apache Tomcat Denial Of Service
Posted Feb 7, 2014
Authored by Mark Thomas | Site tomcat.apache.org

It is possible to craft a malformed Content-Type header for a multipart request that causes Apache Commons FileUpload to enter an infinite loop. A malicious user could, therefore, craft a malformed request that triggered a denial of service. Affected include Apache Tomcat versions 7.0.0 through 7.0.50, 8.0.0-RC1 through 8.0.1, and Apache Commons FileUpload versions 1.0 through 1.3.

tags | advisory, denial of service
advisories | CVE-2014-0050
SHA-256 | 8dfbe0cfb95f092bd86c843cf19490a000e2626be62589af1adf0aa833f36d3c
Apache Tomcat 7.0.39 AsyncListener RuntimeException
Posted May 10, 2013
Authored by Mark Thomas | Site tomcat.apache.org

There was a scenario where elements of a previous request may be exposed to a current request. This was very difficult to exploit deliberately but fairly likely to happen unexpectedly if an application used AsyncListeners that threw RuntimeExceptions. The issue was fixed by catching the RuntimeExceptions. Apache Tomcat versions 7.0.0 through 7.0.39 are affected.

tags | advisory
advisories | CVE-2013-2071
SHA-256 | cde648eb3c646ccc296e6a2d348bb89e68c2c0471e19b83178341c84734cf58f
Page 1 of 3
Back123Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close