Signature Detail

HTTP: Multiple Vendor Apache Tomcat Policy Bypass

This signature detects attempts to exploit a known unauthorized file upload in HP Performance Manager,IBM Rational Quality Manager and Test Lab Manager. It is due to insufficient access control within the Apache Tomcat Manager component. A remote attacker can leverage this by sending a crafted HTTP request using a set of default credentials. Once authenticated, the attacker can upload a malicious Web application to a vulnerable system. In a successful attack, where arbitrary code is injected and executed on the target system, the behavior of the target is dependent on the intention of the malicious code. When installed on a Microsoft Windows system, the injected code runs with the privileges of SYSTEM.

Extended Description

Apache Tomcat is prone to an insecure-password vulnerability. Attackers may exploit this issue to obtain administrative access to the application. Other attacks may also be possible. The following are vulnerable: Tomcat 6.0.0 through 6.0.20 Tomcat 5.5.0 through 5.5.28 Unsupported versions in the 3.x, 4.x, 4.1.x, and 5.0.x branches may also be affected.

Affected Products

• Apache Software Foundation Tomcat 5.5.0
• Apache Software Foundation Tomcat 5.5.1
• Apache Software Foundation Tomcat 5.5.10
• Apache Software Foundation Tomcat 5.5.11
• Apache Software Foundation Tomcat 5.5.12
• Apache Software Foundation Tomcat 5.5.13
• Apache Software Foundation Tomcat 5.5.14
• Apache Software Foundation Tomcat 5.5.15
• Apache Software Foundation Tomcat 5.5.16
• Apache Software Foundation Tomcat 5.5.17
• Apache Software Foundation Tomcat 5.5.18
• Apache Software Foundation Tomcat 5.5.19
• Apache Software Foundation Tomcat 5.5.2
• Apache Software Foundation Tomcat 5.5.20
• Apache Software Foundation Tomcat 5.5.21
• Apache Software Foundation Tomcat 5.5.22
• Apache Software Foundation Tomcat 5.5.23
• Apache Software Foundation Tomcat 5.5.24
• Apache Software Foundation Tomcat 5.5.25
• Apache Software Foundation Tomcat 5.5.26
• Apache Software Foundation Tomcat 5.5.27
• Apache Software Foundation Tomcat 5.5.28
• Apache Software Foundation Tomcat 5.5.3
• Apache Software Foundation Tomcat 5.5.4
• Apache Software Foundation Tomcat 5.5.5
• Apache Software Foundation Tomcat 5.5.6
• Apache Software Foundation Tomcat 5.5.7
• Apache Software Foundation Tomcat 5.5.8
• Apache Software Foundation Tomcat 5.5.9
• Apache Software Foundation Tomcat 6.0.0
• Apache Software Foundation Tomcat 6.0.1
• Apache Software Foundation Tomcat 6.0.10
• Apache Software Foundation Tomcat 6.0.11
• Apache Software Foundation Tomcat 6.0.12
• Apache Software Foundation Tomcat 6.0.13
• Apache Software Foundation Tomcat 6.0.14
• Apache Software Foundation Tomcat 6.0.15
• Apache Software Foundation Tomcat 6.0.16
• Apache Software Foundation Tomcat 6.0.18
• Apache Software Foundation Tomcat 6.0.2
• Apache Software Foundation Tomcat 6.0.20
• Apache Software Foundation Tomcat 6.0.3
• Apache Software Foundation Tomcat 6.0.4
• Apache Software Foundation Tomcat 6.0.5
• Apache Software Foundation Tomcat 6.0.6
• Apache Software Foundation Tomcat 6.0.7
• Apache Software Foundation Tomcat 6.0.8
• Apache Software Foundation Tomcat 6.0.9
• HP HP-UX B.11.11
• HP HP-UX B.11.23
• HP HP-UX B.11.31
• HP HP-UX Web Server Suite 2.31
• HP HP-UX Web Server Suite 3.10
• HP OpenVMS Secure Web Server 1.1
• HP OpenVMS Secure Web Server 1.1.0 -1
• HP OpenVMS Secure Web Server 1.2.0
• HP OpenVMS Secure Web Server 2.1-1
• HP OpenVMS Secure Web Server 2.2
• HP OpenVMS Secure Web Server 7.2.0 -2
• HP OpenVMS Secure Web Server 7.3.0
• HP OpenVMS Secure Web Server 7.3.0 -1
• HP OpenVMS Secure Web Server 7.3.0 -2
• HP Performance Manager 8.10
• HP Performance Manager 8.20
• HP Performance Manager 8.21
• IBM WebSphere Application Server Community Edition 2.0.0
• IBM WebSphere Application Server Community Edition 2.0.0 1
• VMWare ESX Server 4.0
• VMWare ESX Server 4.1
• VMWare vCenter 4.0

References

• BugTraq: 36954
• BugTraq: 44172
• CVE: CVE-2010-4094
• CVE: CVE-2009-3548