USN-899-1: Tomcat vulnerabilities

11 February 2010

Tomcat vulnerabilities




It was discovered that Tomcat did not correctly validate WAR filenames or
paths when deploying. A remote attacker could send a specially crafted WAR
file to be deployed and cause arbitrary files and directories to be
created, overwritten, or deleted.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10
Ubuntu 9.04
Ubuntu 8.10

In general, a standard system upgrade is sufficient to effect the
necessary changes.