Apache Tomcat "sendfile" request attribute information leakage Vulnerability

Release date:
Updated on:

Affected Systems:
Apache Group Tomcat 7.x
Apache Group Tomcat 6.x
Apache Group Tomcat 5.x
Unaffected system:
Apache Group Tomcat 7.0.19
Apache Group Tomcat 6.0.33
Apache Group Tomcat 5.5.34
Description:
--------------------------------------------------------------------------------
Bugtraq id: 48667
Cve id: CVE-2011-2526

Tomcat is a Servlet container developed by the Jakarta project under the Apache Software Foundation. According to the technical specifications provided by Sun Microsystems, Tomcat supports Servlet and JavaServer Page (JSP, it also provides some special functions as Web servers.

Apache Tomcat has the information leakage vulnerability in processing sendfile request attributes. Remote attackers can exploit this vulnerability to obtain sensitive information or cause JVM crash.

Apache Tomcat versions earlier than 5.5.34, 6.0.33, and 7.0.19 do not validate certain request attributes when http apr or http nio connector sendfile is enabled, attackers can bypass planned file access restrictions or cause denial-of-service through suspicious Web applications.

<* Source: Cisco

Link: http://tomcat.apache.org/security-7.html
Http://www.ibm.com/support/docview.wss? Uid = swg21507512
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://jakarta.apache.org/tomcat/index.html