.:[ packet storm ]:.
                               
reconnaissance for both sides
reconnaissance for both sides

 ///  File Name:MDVSA-2008-188.txt
Description:
Mandriva Linux Security Advisory - A number of vulnerabilities have been discovered in the Apache Tomcat server. The default catalina.policy in the JULI logging component did not restrict certain permissions for web applications which could allow a remote attacker to modify logging configuration options and overwrite arbitrary files. A cross-site scripting vulnerability was found in the HttpServletResponse.sendError() method which could allow a remote attacker to inject arbitrary web script or HTML via forged HTTP headers. A cross-site scripting vulnerability was found in the host manager application that could allow a remote attacker to inject arbitrary web script or HTML via the hostname parameter. A traversal vulnerability was found when using a RequestDispatcher in combination with a servlet or JSP that could allow a remote attacker to utilize a specially-crafted request parameter to access protected web resources. A traversal vulnerability was found when the 'allowLinking' and 'URIencoding' settings were actived which could allow a remote attacker to use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. The updated packages have been patched to correct these issues.
Homepage:http://www.mandriva.com/security/
File Size:8691
Related CVE(s):CVE-2007-5342, CVE-2008-1232, CVE-2008-1947, CVE-2008-2370, CVE-2008-2938
Last Modified:Sep 5 20:23:13 2008
MD5 Checksum:fa0a6a8003587117a6311ddf437cc6f1

 .:. Back
 

 ///  Last 10 Files
  1. :· ZDI-08-076.txt
  2. :· ZDI-08-075.txt
  3. :· toursmanager-blindsql.txt
  4. :· phprsgal-sql.txt
  5. :· MDVSA-2008-233.txt
  6. :· java2-malware.pdf
  7. :· natterchat-sql.txt
  8. :· php526-bypass.txt
  9. :· phpfusion7001-sql.txt
  10. :· social-sql.txt
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Advisories
  1. :· ZDI-08-076.txt
  2. :· ZDI-08-075.txt
  3. :· MDVSA-2008-233.txt
  4. :· SSRT080059.txt
  5. :· MDVSA-2008-220-1.txt
  6. :· MDVSA-2008-232.txt
  7. :· USN-674-1.txt
  8. :· dsa-1667-1.txt
  9. :· PR08-09.txt
  10. :· secunia-streamripper.txt
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Exploits
  1. :· toursmanager-blindsql.txt
  2. :· phprsgal-sql.txt
  3. :· natterchat-sql.txt
  4. :· php526-bypass.txt
  5. :· phpfusion7001-sql.txt
  6. :· social-sql.txt
  7. :· vbulletin-xssxsrf.txt
  8. :· askpert-sql.txt
  9. :· backlinkspider-sql.txt
  10. :· exodus-injection.txt
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Tools
  1. :· pysumpas-0.2.0.tar.gz
  2. :· framework-3.2.tar.gz
  3. :· tor.uclibc.i686.20081115.iso
  4. :· RFIDIOt-Windows-0.1u.zip
  5. :· RFIDIOt-0.1u.tgz
  6. :· dps-v1.5.tar.gz
  7. :· smbrelay3.zip
  8. :· mptrey.tar.gz
  9. :· dotnetsploitsrc-1.0.zip
  10. :· MultiInjectorV0.3.tar.gz
[ Last 20 | Last 50 | Last 100 ]

 ///  Last 10 Misc
  1. :· java2-malware.pdf
  2. :· return-to-libc-linux.txt
  3. :· stack-overflow-linux.txt
  4. :· smallest_setuid_execve_sc.c
  5. :· sudoers-shellcode.txt
  6. :· strongswan-4.2.9.tar.gz
  7. :· hodetector-shellcode.txt
  8. :· rtm-essential5.pdf
  9. :· unixasm-1.3.0.tar.gz
  10. :· bnd-networks.pdf
[ Last 20 | Last 50 | Last 100 ]


 .:. TopPrivacy Statement | Copyright Notice