Apache Tomcat DefaultServlet存在文件泄露漏洞发布时间：2002-09-27 更新时间：2002-09-27 严重程度：高 威胁程度：口令恢复 错误类型：设计错误 利用方式：服务器模式 BUGTRAQ ID：5786 受影响系统 Apache Software Foundation Tomcat 3.0详细描述 Apache Tomcat默认包含"org.apache.catalina.servlets.DefaultServlet" Servlet程序。 利用上面这个servlet可查看WEBROOT中的任意文件，导致获得JSP源代码，泄露数据库用户名和密码。 测试代码 如原来http://target/admin/target.jsp的页面可使用如下请求获得源代码： http://target/admin/servlet/org.apache.catalina.servlets.DefaultServlet/target.jsp 解决方案 如果apache或者其他HTTP服务器使用前端方式，过滤*/servlet/org.apache.catalina.servlets.DefaultServlet* 请求。如果以mod_jk/jk2方式运作，过滤不需要的URLS/servlet访问。 或者在web.xml增加如下代码： <security-constraint> <display-name>Default Servlet</display-name> <!-- Disable direct alls on the Default Servlet</web-resource-name --> <web-resource-collection> <web-resource-name>Disallowed Location</web-resource-name> <url-pattern>/servlet/org.apache.catalina.servlets.DefaultServlet/*</url-pat tern> <http-method>DELETE</http-method> <http-method>GET</http-method> <http-method>POST</http-method> <http-method>PUT</http-method> </web-resource-collection> <auth-constraint> <role-name></role-name> </auth-constraint> </security-constraint> 升级程序： Apache Software Foundation Tomcat 3.0: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.1: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.1.1: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.2: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.2.1: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.2.2 beta2: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.2.3: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.2.4: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.3: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 3.3.1: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 4.0: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 4.0.1: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 4.0.2: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 4.0.3: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 4.0.4: Apache Software Foundation Upgrade Jakarta Tomcat 4.0.5 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.0.5/ Apache Software Foundation Tomcat 4.1: Apache Software Foundation Upgrade Jakarta Tomcat 4.1.12 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/ Apache Software Foundation Tomcat 4.1.3 beta: Apache Software Foundation Upgrade Jakarta Tomcat 4.1.12 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/ Apache Software Foundation Tomcat 4.1.9 beta: Apache Software Foundation Upgrade Jakarta Tomcat 4.1.12 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/ Apache Software Foundation Tomcat 4.1.10: Apache Software Foundation Upgrade Jakarta Tomcat 4.1.12 http://jakarta.apache.org/builds/jakarta-tomcat-4.0/release/v4.1.12/ 相关信息 Rossen Raykov <Rossen.Raykov@CognicaseUSA.com>. 参考：http://online.securityfocus.com/advisories/4503 http://online.securityfocus.com/archive/1/292936 http://online.securityfocus.com/archive/1/293050 |
