Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 261469 (CVE-2009-0781) - <www-servers/tomcat-{5.5.27-r3, 6.0.18-r3}: XSS (CVE-2009-0781)
Summary: <www-servers/tomcat-{5.5.27-r3, 6.0.18-r3}: XSS (CVE-2009-0781)
Status: RESOLVED FIXED
Alias: CVE-2009-0781
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: http://tomcat.apache.org/security.html
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-06 17:16 UTC by Mike Weissman
Modified: 2009-03-18 22:50 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Weissman 2009-03-06 17:16:00 UTC
CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability

Severity: low

Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27

Description:
The calendar application in the examples contains invalid HTML which renders the XSS protection for the time parameter ineffective. An attacker can therefore perform an XSS attack using the time attribute.

Example:
http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS')});

Credit:
This issue was discovered by Deniz Cevik.

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-4.html

submitting Patches to 6/5.5-r6 in [java-experimental]


Thanks,
weisso

Reproducible: Always
Comment 1 Mike Weissman 2009-03-06 17:33:23 UTC
submitted as revision 7597 in [java-experimental]


Thanks,
weisso
Comment 2 Petteri Räty (RETIRED) gentoo-dev 2009-03-06 18:49:44 UTC
+*tomcat-6.0.18-r3 (06 Mar 2009)
+*tomcat-5.5.27-r3 (06 Mar 2009)
+
+  06 Mar 2009; Petteri Räty <betelgeuse@gentoo.org>
+  +files/5.5/examples-cal.patch, +files/6/examples-cal.patch,
+  +tomcat-5.5.27-r3.ebuild, +tomcat-6.0.18-r3.ebuild:
+  Add patch for XSS issue in examples for security bug #261460. Use use deps
+  in 5.5.
+
Comment 3 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-03-06 19:10:21 UTC
Arches, please test and mark stable:
=www-servers/tomcat-6.0.18-r3
=www-servers/tomcat-5.5.27-r3
Target keywords : "amd64 ppc ppc64 x86"
Comment 4 Markus Meier gentoo-dev 2009-03-07 10:54:56 UTC
amd64/x86 stable
Comment 5 Brent Baude (RETIRED) gentoo-dev 2009-03-11 15:05:08 UTC
ppc64 done
Comment 6 Stefan Behte (RETIRED) gentoo-dev Security 2009-03-11 23:39:56 UTC
CVE-2009-0781 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0781):
  Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the
  calendar application in the examples web application in Apache Tomcat
  4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18
  allows remote attackers to inject arbitrary web script or HTML via
  the time parameter, related to "invalid HTML."

Comment 7 Brent Baude (RETIRED) gentoo-dev 2009-03-18 22:37:12 UTC
ppc done
Comment 8 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-03-18 22:47:17 UTC
Ready for GLSA voting, I say NO.
Comment 9 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-03-18 22:50:14 UTC
NO too, closing.