Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS13NjVqLWNtcWMtMzdwMs2pSg
JULI logging component in Apache Tomcat does not restrict certain permissions for web applications
The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NjVqLWNtcWMtMzdwMs2pSg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 8 months ago
Identifiers: GHSA-w65j-cmqc-37p2, CVE-2007-5342
References:
- https://nvd.nist.gov/vuln/detail/CVE-2007-5342
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39201
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10417
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://marc.info/?l=bugtraq&m=139344343412337&w=2
- http://security.gentoo.org/glsa/glsa-200804-10.xml
- http://securityreason.com/securityalert/3485
- http://support.apple.com/kb/HT3216
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- http://svn.apache.org/viewvc?view=rev&revision=606594
- http://tomcat.apache.org/security-5.html
- http://tomcat.apache.org/security-6.html
- http://www.debian.org/security/2008/dsa-1447
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:188
- http://www.redhat.com/support/errata/RHSA-2008-0042.html
- http://www.redhat.com/support/errata/RHSA-2008-0195.html
- http://www.redhat.com/support/errata/RHSA-2008-0831.html
- http://www.redhat.com/support/errata/RHSA-2008-0832.html
- http://www.redhat.com/support/errata/RHSA-2008-0833.html
- http://www.redhat.com/support/errata/RHSA-2008-0834.html
- http://www.redhat.com/support/errata/RHSA-2008-0862.html
- http://www.securityfocus.com/archive/1/485481/100/0/threaded
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://www.securityfocus.com/bid/27006
- http://www.securityfocus.com/bid/31681
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
- https://github.com/advisories/GHSA-w65j-cmqc-37p2
Affected Packages
maven:org.apache.tomcat:tomcat-juli
Dependent packages: 168Dependent repositories: 1,440
Downloads:
Affected Version Ranges: >= 6.0.0, <= 6.0.15, >= 5.5.9, <= 5.5.25
No known fixed version
All affected versions: