CVE-2007-5342: Tomcat's default security policy is too open Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.9 to 5.5.25 Tomcat 6.0.0 to 6.0.15 Description: The JULI logging component allows web applications to provide their own logging configurations. The default security policy does not restrict this configuration and allows an untrusted web application to add files or overwrite existing files where the Tomcat process has the necessary file permissions to do so. Mitigation: Apply the following patch to the catalina.policy file http://svn.apache.org/viewvc?rev=606594&view=rev The patch will be included in 5.5.25 onwards and 6.0.16 onwards This patch is also included at the end of this announcement
Filed bug myself, upstream will correct defaults. I will apply changes ASAP. Kinda have existing issues with using security manager and default security policies as is. Thus dependency on other existing bug regarding those issues :) Pretty sure there will be a new release soon. Been waiting on that for another CVE bug for Tomcat as well. Both some what minor and moot IMHO, but will work and resolve them ASAP.
Thanks for reporting. I assume the other CVE you mean is bug 196066.
ping, what's the status here?
Haven't had a chance to work it. Not sure upstream has reacted. They have been talking about a release of both 5.5.x and 6.0.x for over a month now. Hopefully any day now a vote will take place and they will release a new version. So I can close the Tomcat webdav bug 196066 as well. Otherwise I need to go fetch their solution to that one, and this one from vc. Assuming both have been addressed in vc. HOWEVER, even when upstream addresses this issue specifically. It's kinda moot for us on Gentoo, because of bug 176701. Stuff doesn't even really work now, so if default file is to open. Really means squat to us :) The default stuff doesn't work for us, and is WAY to locked down. I have to dial it in for split tomcat and etc. So not sure their default being to open even matters on Gentoo. Considering the some of the default apps that ship don't have permissions or etc in the default policy file. It's a mess, no time to resolve. Me personally I have had so many past headaches with using a security manager. I don't run one at all these days. Mostly for local protection anyway. Prevent devs from doing bad stuff in a container like System.exit() etc. To use as is, most would have to modify it for their needs anyway. I don't think I would GLSA this or etc. It's very minor and quite moot, IMHO. Kinda like the other bug 196066. Just filed the bug before someone else could ;)
Rerating as B4 since running untrusted webapps is a bad idea anyway.
Any news on this one?
Well since this is basically an upstream bug, and we have new versions in tree 5.5.26/6.0.16. I believe the issue was address by upstream. Still doesn't address our bug 176701. But that's usability not security. Pretty sure we are good on this one. Can close, move on, etc.
Upstream confirmed, this is fixed in 6.0.16 and 5.5.26, which are both stable targets in bug 196066. http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html
Should we release a GLSA for this one along with 176701? I tend to vote NO.
Sune, is that a no for the whole list of bugs listed at the above url, or just this one?
Hmmm reading the bug list again I tend to vote YES.
YES, filed.
GLSA 200804-10, sorry for the delay.
