HTTP: Multiple Vendor Apache Tomcat Policy Bypass

This signature detects attempts to exploit a known unauthorized file upload in HP Performance Manager,IBM Rational Quality Manager and Test Lab Manager. It is due to insufficient access control within the Apache Tomcat Manager component. A remote attacker can leverage this by sending a crafted HTTP request using a set of default credentials. Once authenticated, the attacker can upload a malicious Web application to a vulnerable system. In a successful attack, where arbitrary code is injected and executed on the target system, the behavior of the target is dependent on the intention of the malicious code. When installed on a Microsoft Windows system, the injected code runs with the privileges of SYSTEM.

Extended Description

Apache Tomcat is prone to an insecure-password vulnerability. Attackers may exploit this issue to obtain administrative access to the application. Other attacks may also be possible. The following are vulnerable: Tomcat 6.0.0 through 6.0.20 Tomcat 5.5.0 through 5.5.28 Unsupported versions in the 3.x, 4.x, 4.1.x, and 5.0.x branches may also be affected.

Affected Products

Apache_software_foundation tomcat

References

BugTraq: 44172 36954

CVE: CVE-2009-4189

URL: http://www.zerodayinitiative.com/advisories/zdi-10-214/ http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c01931960

Short Name

HTTP:TOMCAT:POLICY-BYPASS

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Multiple Vendor Apache Tomcat Policy Bypass

Extended Description

Affected Products

References

Found a potential security threat?