The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of NNMi

computer vulnerability note CVE-2007-5333 CVE-2007-5342 CVE-2007-5461

Apache Tomcat 6.0.14/15: several vulnerabilities

Synthesis of the vulnerability

Several vulnerabilities affect Apache Tomcat 6.0.14/15.
Impacted products: Tomcat, BES, HPE NNMi, Mandriva Linux, openSUSE, Solaris, RHEL, ESX, ESXi, VMware Server, vCenter Server, VirtualCenter.
Severity: 2/4.
Consequences: data reading, data creation/edition.
Provenance: internet client.
Number of vulnerabilities in this bulletin: 5.
Creation date: 11/02/2008.
Identifiers: BID-26070, BID-27006, BID-27703, BID-27706, BID-49470, c03824583, CERTA-2007-AVI-470, CERTA-2007-AVI-569, CERTA-2008-AVI-066, CERTA-2013-AVI-440, CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-5641-ERROR, CVE-2007-6286, CVE-2008-0002, HPSBMU02894, KB25966, MDVSA-2010:176, RHSA-2008:0524-01, RHSA-2009:1562-01, RHSA-2009:1563-01, RHSA-2010:0602-02, SNS Advisory No.97, SUSE-SR:2008:005, VIGILANCE-VUL-7569, VMSA-2009-0016, VMSA-2009-0016.1, VMSA-2009-0016.2, VMSA-2009-0016.3, VMSA-2009-0016.4, VMSA-2009-0016.5.

Description of the vulnerability

Several vulnerabilities affect Apache Tomcat 6.0.14/15.

Patch for VIGILANCE-VUL-7084 vulnerability was incomplete. [severity:2/4; BID-27706, CERTA-2008-AVI-066, CVE-2007-5333, SNS Advisory No.97]

A malicious application can use JULI in order to alter some files (VIGILANCE-VUL-7456). [severity:1/4; BID-27006, CERTA-2007-AVI-569, CVE-2007-5342]

An attacker allowed with a write access via WebDAV can read a file located on the system (VIGILANCE-VUL-7260). [severity:2/4; BID-26070, CERTA-2007-AVI-470, CVE-2007-5461, CVE-2007-5641-ERROR]

When the native (APR) connector is used, an attacker can connect to the SSL port and obtain data of another session. [severity:1/4; BID-49470, CVE-2007-6286]

If the client disconnects, sent parameters can be processed by the next request. [severity:1/4; BID-27703, CVE-2008-0002]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2007-5333 CVE-2007-5342 CVE-2007-5461

Apache Tomcat 5.5.25: several vulnerabilities

Synthesis of the vulnerability

Several vulnerabilities affect Apache Tomcat 5.5.25.
Impacted products: Tomcat, BES, Fedora, HPE NNMi, JBoss AS OpenSource, Mandriva Linux, openSUSE, Solaris, RHEL, JBoss EAP by Red Hat, ESX, ESXi, VMware Server, vCenter Server, VirtualCenter.
Severity: 2/4.
Consequences: data reading, data creation/edition.
Provenance: internet client.
Number of vulnerabilities in this bulletin: 4.
Creation date: 11/02/2008.
Identifiers: BID-26070, BID-27006, BID-27706, BID-49470, c03824583, CERTA-2007-AVI-470, CERTA-2007-AVI-569, CERTA-2008-AVI-066, CERTA-2013-AVI-440, CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-5641-ERROR, CVE-2007-6286, FEDORA-2008-1467, FEDORA-2008-1603, HPSBMU02894, KB25966, MDVSA-2008:188, MDVSA-2009:018, MDVSA-2010:176, RHSA-2008:0042-01, RHSA-2008:0195-01, RHSA-2008:0261-01, RHSA-2008:0524-01, RHSA-2008:0862-02, RHSA-2009:1164-01, RHSA-2009:1454-01, RHSA-2009:1562-01, RHSA-2009:1563-01, RHSA-2009:1616-01, RHSA-2010:0602-02, SNS Advisory No.97, SUSE-SR:2008:005, VIGILANCE-VUL-7568, VMSA-2008-00010.3, VMSA-2009-0016, VMSA-2009-0016.1, VMSA-2009-0016.2, VMSA-2009-0016.3, VMSA-2009-0016.4, VMSA-2009-0016.5.

Description of the vulnerability

Several vulnerabilities affect Apache Tomcat 5.5.25.

Patch for VIGILANCE-VUL-7084 vulnerability was incomplete. [severity:2/4; BID-27706, CERTA-2008-AVI-066, CVE-2007-5333, SNS Advisory No.97]

A malicious application can use JULI in order to alter some files (VIGILANCE-VUL-7456). [severity:1/4; BID-27006, CERTA-2007-AVI-569, CVE-2007-5342]

An attacker allowed with a write access via WebDAV can read a file located on the system (VIGILANCE-VUL-7260). [severity:2/4; BID-26070, CERTA-2007-AVI-470, CVE-2007-5461, CVE-2007-5641-ERROR]

When the native (APR) connector is used, an attacker can connect to the SSL port and obtain data of another session. [severity:1/4; BID-49470, CVE-2007-6286]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2005-3164 CVE-2007-1355 CVE-2007-2449

Apache Tomcat 4.1.36: several vulnerabilities

Synthesis of the vulnerability

Several vulnerabilities affect Apache Tomcat 4.1.36.
Impacted products: Tomcat, BES, HPE NNMi, Mandriva Linux, NLD, OES, openSUSE, Solaris, RHEL, SLES, ESX, ESXi, VMware Server, vCenter Server, VirtualCenter.
Severity: 2/4.
Consequences: client access/rights, data reading, data creation/edition.
Provenance: internet client.
Number of vulnerabilities in this bulletin: 8.
Creation date: 11/02/2008.
Identifiers: 239312, BID-24058, BID-24999, BID-25316, BID-26070, BID-27706, c03824583, CERTA-2007-AVI-267, CERTA-2007-AVI-362, CERTA-2007-AVI-470, CERTA-2008-AVI-066, CERTA-2008-AVI-343, CERTA-2011-AVI-221, CERTA-2013-AVI-440, CVE-2005-3164, CVE-2007-1355, CVE-2007-2449, CVE-2007-2450, CVE-2007-3382, CVE-2007-3383, CVE-2007-3385, CVE-2007-5333, CVE-2007-5461, CVE-2007-5641-ERROR, HPSBMU02894, KB25966, MDVSA-2010:176, RHSA-2008:0524-01, RHSA-2009:1562-01, RHSA-2009:1563-01, RHSA-2010:0602-02, SNS Advisory No.97, SUSE-SR:2008:005, SUSE-SR:2008:007, VIGILANCE-VUL-7567, VMSA-2009-0016, VMSA-2009-0016.1, VMSA-2009-0016.2, VMSA-2009-0016.3, VMSA-2009-0016.4, VMSA-2009-0016.5, VU#862600, VU#993544.

Description of the vulnerability

Several vulnerabilities affect Apache Tomcat 4.1.36.

Two vulnerabilities of HTTP and AJP connectors permit an attacker to obtain information (VIGILANCE-VUL-6808). [severity:1/4; CERTA-2008-AVI-343, CVE-2005-3164]

An attacker can use the example provided in the documentation in order to generate a Cross Site Scripting attack (VIGILANCE-VUL-6819). [severity:1/4; BID-24058, CERTA-2007-AVI-362, CVE-2007-1355]

An attacker can exploit two Cross Site Scripting attacks on Apache Tomcat (VIGILANCE-VUL-6915). [severity:2/4; CERTA-2007-AVI-267, CVE-2007-2449, CVE-2007-2450]

An attacker can obtain value of victim's cookies by using special characters (VIGILANCE-VUL-7084). [severity:2/4; BID-25316, CVE-2007-3382, VU#993544]

The SendMailServlet example can be used to generate Cross Site Scripting attacks (VIGILANCE-VUL-7083). [severity:1/4; BID-24999, CVE-2007-3383, VU#862600]

An attacker can obtain value of victim's cookies by using special characters (VIGILANCE-VUL-7084). [severity:2/4; BID-25316, CERTA-2011-AVI-221, CVE-2007-3385, VU#993544]

Patch for VIGILANCE-VUL-7084 vulnerability was incomplete. [severity:2/4; BID-27706, CERTA-2008-AVI-066, CVE-2007-5333, SNS Advisory No.97]

An attacker allowed with a write access via WebDAV can read a file located on the system (VIGILANCE-VUL-7260). [severity:2/4; BID-26070, CERTA-2007-AVI-470, CVE-2007-5461, CVE-2007-5641-ERROR]
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2007-1858

Tomcat: Anonymous Cipher allowed

Synthesis of the vulnerability

By default, a client can establish a SSL session using an Anonymous Cipher.
Impacted products: Tomcat, BES, HPE NNMi, NLD, OES, openSUSE, RHEL, SLES.
Severity: 1/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 10/05/2007.
Identifiers: BID-28482, c03223954, CVE-2007-1858, HPSBMU02744, KB25966, RHSA-2007:0326-01, SSRT100776, SUSE-SR:2008:007, VIGILANCE-VUL-6810.

Description of the vulnerability

When a SSL session is established, both parts choose algorithms corresponding to the requested security level. "Anonymous Cipher" algorithms permit to establish a session without certificates, but are sensitive to a Man-in-the-middle attack.

Default configuration of Tomcat allows Anonymous Ciphers.

If administrator incorrectly installed its server certificate, SSL sessions are thus not securely established. Administrator may not see that his server is badly configured.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about NNMi: