Ubuntu
tomcat5.5 package

[CVE-2007-5333] Unauthorized disclosure of information

Bug #220540 reported by Matti Lindell
256
Affects Status Importance Assigned to Milestone
tomcat5.5 (Debian)
Fix Released
Unknown
tomcat5.5 (Ubuntu)
Fix Released
Undecided
Unassigned
Hardy
Won't Fix
Undecided
Unassigned

Bug Description

Binary package hint: tomcat5.5

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333

Edgy, Feisty, Gutsy and Hardy are affected. Dapper doesn't have the package. Fixed version is available in Debian.

See original description

CVE References

Revision history for this message
William Grant (wgrant) wrote :

Please check https://launchpad.net/bugs/cve/CVE-XXXX-XXXX before filing duplicates.

Revision history for this message
Matti Lindell (mlind) wrote :

Sorry, I meant to report CVE-2007-5333 and CVE-2007-6286 which are not fixed in Hardy, Gutsy, Feisty or Edgy.

Revision history for this message
William Grant (wgrant) wrote :

We don't use the APR connector, so -6286 doesn't affect us.

Matti Lindell (mlind)
description: updated
Bug Watch Updater (bug-watch-updater)
Changed in tomcat5.5:
status: Unknown → Fix Released
Revision history for this message
Thierry Carrez (ttx) wrote :

Intrepid ships 5.5.26 so this is fixed in the development version.

Changed in tomcat5.5:
status: New → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug and helping to make Ubuntu better. The package referred to in this bug is in universe or multiverse and reported against a release of Ubuntu (hardy) which no longer receives updates outside of the explicitly supported LTS packages. While the bug against hardy is being marked "Won't Fix" for now, if you are interested feel free to post a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures'

Please feel free to report any other bugs you may find.

Changed in tomcat5.5 (Ubuntu Hardy):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.