CVE-2000-0759
CVSS6.4
发布时间 :2000-10-20 00:00:00
修订时间 :2008-09-05 16:21:49
NMCOES    

[原文]Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.


[CNNVD]Apache Tomcat 3.1远程泄露服务器信息漏洞(CNNVD-200010-134)

        
        Apache Group Tomcat是一个免费开放源码的JSP服务器程序。
        Apache Group Tomcat 3.1在处理不存在的JSP文件请求时存在问题,远程攻击者可能借此收集到服务器相关的配置信息。
        当向Apache Group Tomcat 3.1提交请求,访问一个不存在的JSP文件时,服务器返回太多敏感信息,包括WEB服务物理路径。这些信息潜在损害着系统安全性,有可能被攻击者利用。
        

- CVSS (基础分值)

CVSS分值: 6.4 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0759
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0759
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200010-134
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26date%3D2000-07-15%26msg%3DPine.SUN.3.96.1000719184401.17782A-100000@grex.cyberspace.org
(VENDOR_ADVISORY)  BUGTRAQ  20000719 [LoWNOISE] Tomcat 3.1 Path Revealing Problem.
http://www.securityfocus.com/bid/1531
(VENDOR_ADVISORY)  BID  1531
http://www.iss.net/security_center/static/4967.php
(UNKNOWN)  XF  tomcat-error-path-reveal(4967)

- 漏洞信息

Apache Tomcat 3.1远程泄露服务器信息漏洞
中危 设计错误
2000-10-20 00:00:00 2006-08-03 00:00:00
远程  
        
        Apache Group Tomcat是一个免费开放源码的JSP服务器程序。
        Apache Group Tomcat 3.1在处理不存在的JSP文件请求时存在问题,远程攻击者可能借此收集到服务器相关的配置信息。
        当向Apache Group Tomcat 3.1提交请求,访问一个不存在的JSP文件时,服务器返回太多敏感信息,包括WEB服务物理路径。这些信息潜在损害着系统安全性,有可能被攻击者利用。
        

- 公告与补丁

        厂商补丁:
        Apache Group
        ------------
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        
        http://jakarta.apache.org/tomcat/index.html

- 漏洞信息 (20131)

Apache Tomcat 3.1 Path Revealing Vulnerability (EDBID:20131)
multiple remote
2000-07-20 Verified
0 ET LoWNOISE
N/A [点击下载]
source: http://www.securityfocus.com/bid/1531/info

A vulnerability exists in the JSP portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent JSP file, too much information is presented by the server as part of the error message. This information may be useful to a would be attacker in conducting further attacks. 

http://narco.guerrilla.sucks.co:8080/anything.jsp

Error: 404
Location: /anything.jsp

JSP file "/appsrv2/jakarta-tomcat/webapps/ROOT/anything.jsp" not found 		

- 漏洞信息

674
Apache Tomcat Nonexistent File Error Message Path Disclosure
Remote / Network Access Information Disclosure
Loss of Confidentiality Upgrade
Exploit Public Vendor Verified, Third-party Verified

- 漏洞描述

- 时间线

2000-07-19 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 3.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Apache Tomcat 3.1 Path Revealing Vulnerability
Design Error 1531
Yes No
2000-07-20 12:00:00 2009-07-11 02:56:00
This vulnerability was posted to the Bugtraq mailing list on July 20, 2000 by ET LoWNOISE <et@cyberspace.org>

- 受影响的程序版本

Apache Software Foundation Tomcat 3.1
- BSDI BSD/OS 4.0
- Caldera OpenLinux 2.4
- Conectiva Linux 5.1
- Debian Linux 2.2
- Debian Linux 2.1
- Digital UNIX 4.0
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- NetBSD NetBSD 1.4.2 x86
- NetBSD NetBSD 1.4.1 x86
- RedHat Linux 6.2 i386
- RedHat Linux 6.1 i386
- SGI IRIX 6.5
- SGI IRIX 6.4
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Apache Software Foundation Tomcat 3.0
- BSDI BSD/OS 4.0
- Caldera OpenLinux 2.4
- Debian Linux 2.2
- Debian Linux 2.1
- Digital UNIX 4.0
- FreeBSD FreeBSD 5.0
- FreeBSD FreeBSD 4.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- NetBSD NetBSD 1.4.2 x86
- NetBSD NetBSD 1.4 x86
- RedHat Linux 6.2 i386
- RedHat Linux 6.1 i386
- SGI IRIX 6.5
- SGI IRIX 6.4
- Sun Solaris 8_sparc
- Sun Solaris 7.0
Apache Software Foundation JSP 1.1
+ Apache Software Foundation Tomcat 3.1
Apache Software Foundation Tomcat 3.1.1

- 不受影响的程序版本

Apache Software Foundation Tomcat 3.1.1

- 漏洞讨论

A vulnerability exists in the JSP portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent JSP file, too much information is presented by the server as part of the error message. This information may be useful to a would be attacker in conducting further attacks.

- 漏洞利用

http://narco.guerrilla.sucks.co:8080/anything.jsp

Error: 404
Location: /anything.jsp

JSP file "/appsrv2/jakarta-tomcat/webapps/ROOT/anything.jsp" not found

- 解决方案

This issue has been resolved in version 3.1.1 and later.


Apache Software Foundation Tomcat 3.0

Apache Software Foundation Tomcat 3.1

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站