medium4.3
CVE-2009-2901
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a…
Impact
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Tomcat | Versions 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
- http://marc.info/?l=bugtraq&m=127420533226623&w=2
- http://marc.info/?l=bugtraq&m=133469267822771&w=2
- http://marc.info/?l=bugtraq&m=139344343412337&w=2
- http://secunia.com/advisories/38316
- http://secunia.com/advisories/38346
- http://secunia.com/advisories/38541
- http://secunia.com/advisories/39317
- http://secunia.com/advisories/43310
- http://secunia.com/advisories/57126
- http://securitytracker.com/id?1023503
- http://support.apple.com/kb/HT4077
- http://svn.apache.org/viewvc?rev=892815&view=rev
- http://svn.apache.org/viewvc?rev=902650&view=rev
- http://tomcat.apache.org/security-5.html
- http://tomcat.apache.org/security-6.html
- http://ubuntu.com/usn/usn-899-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:176
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:177
- http://www.securityfocus.com/archive/1/509151/100/0/threaded
- http://www.securityfocus.com/archive/1/516397/100/0/threaded