CVE-2007-1860

中 5.0CVE-2007-1860 · 25/05/2007 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
tomcat jk web server connector apache	`≤ 1.2.22`	修正版なし

概要

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

参考情報

docs.info.apple.com/article.html
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp
lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
secunia.com/advisories/25383 · Patch
secunia.com/advisories/25701 · Vendor Advisory
secunia.com/advisories/26235 · Vendor Advisory
secunia.com/advisories/26512 · Vendor Advisory
secunia.com/advisories/27037 · Vendor Advisory
secunia.com/advisories/29242 · Vendor Advisory
security.gentoo.org/glsa/glsa-200708-15.xml
tomcat.apache.org/connectors-doc/news/20070301.html · Patch
tomcat.apache.org/security-jk.html · Patch
debian.org/security/2007/dsa-1312
osvdb.org/34877
redhat.com/support/errata/RHSA-2007-0379.html · Vendor Advisory
redhat.com/support/errata/RHSA-2008-0261.html
securityfocus.com/bid/24147
securityfocus.com/bid/25159
securitytracker.com/id
vupen.com/english/advisories/2007/1941 · Vendor Advisory
vupen.com/english/advisories/2007/2732 · Vendor Advisory
vupen.com/english/advisories/2007/3386 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/34496
lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6002

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン