[Note] Tomcat full-system and explosive Security Vulnerabilities

For messages from the Tomcat email list, all Tomcat vulnerabilities are exposed.

CVE-2011-2526: Apache Tomcat Information disclosure and availability vulnerabilities
 
Security level: low

This vulnerability affects all current Tomcat versions. The Tomcat development team said that the fix version will be released soon.

But don't worry. This vulnerability exists only in the following situations:

A) untrusted web applications are being used
B) the SecurityManager is used to limit the untrusted web applications
C) the http nio or http apr connector is used
D) sendfile is enabled for the connector (this is the default)

Vulnerability description:

Tomcat provides support for sendfile with the http nio and http apr connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use
It directly via setting request attributes. these request attributes were not validated. when running under a security manager, this lack of validation allowed a malicious web application to do one or more of the following that wocould normally be prevented by a security manager:) return files to users that the security manager shocould make inaccessible B) terminate (via a crash) the JVM