CVE-2007-5342

Apache Tomcat 5.5.9-5.5.25 and 6.0.0-6.0.15 - Arbitrary File Write via JULI Logging Configuration

Title source: llm

Description

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.

References (50)

Core 50

Core References

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html

Patch x_refsource_misc

http://svn.apache.org/viewvc?view=rev&revision=606594

Various Sources x_refsource_confirm

http://tomcat.apache.org/security-6.html

Various Sources x_refsource_confirm

http://tomcat.apache.org/security-5.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30676

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0862.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28915

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/2823

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10417

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37460

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29313

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/31681

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32120

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0042.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28274

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2008:188

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28317

Vendor Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/3485

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/485481/100/0/threaded

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0832.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/57126

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32222

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0195.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200804-10.xml

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/39201

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0833.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1856/references

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2008-0010.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/39833

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/0013

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/2780

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0831.html

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/27006

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0834.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2008/dsa-1447

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT3216

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29711

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/3316

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32266

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Scores

EPSS 0.0516

EPSS Percentile 91.5%

Details

CWE

CWE-264

Status published

Products (34)

apache/tomcat 5.5.9

apache/tomcat 5.5.10

apache/tomcat 5.5.11

apache/tomcat 5.5.12

apache/tomcat 5.5.13

apache/tomcat 5.5.14

apache/tomcat 5.5.15

apache/tomcat 5.5.16

apache/tomcat 5.5.17

apache/tomcat 5.5.18

... and 24 more

Published Dec 27, 2007

Tracked Since Feb 18, 2026