Vulnerabilità: CVE-2007-3385

Apache Tomcat 6.0.0 alla 6.0.13, 5.5.0 alla 5.5.24, 5.0.0 alla 5.0.30, 4.1.0 alla 4.1.36, e 3.3 a 3.3.2 non gestisce correttamente il \"" sequenza di caratteri in un valore del cookie, che potrebbe causare informazioni sensibili come ID di sessione da trapelato agli aggressori remoti e consentire attacchi di dirottamento di sessione.


http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55562
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
http://www.securityfocus.com/bid/25316
http://www.securityfocus.com/archive/1/476444/100/0/threaded
http://www.securityfocus.com/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/500412/100/0/threaded
http://www.kb.cert.org/vuls/id/993544
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://support.apple.com/kb/HT2163
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-6.html
http://www.debian.org/security/2008/dsa-1447
http://www.debian.org/security/2008/dsa-1453
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9549
http://www.redhat.com/support/errata/RHSA-2007-0871.html
http://www.redhat.com/support/errata/RHSA-2007-0950.html
http://www.redhat.com/support/errata/RHSA-2008-0195.html
http://www.redhat.com/support/errata/RHSA-2008-0261.html
http://securitytracker.com/id?1018557
http://secunia.com/advisories/26466
http://secunia.com/advisories/26898
http://secunia.com/advisories/27037
http://secunia.com/advisories/27267
http://secunia.com/advisories/27727
http://secunia.com/advisories/28317
http://secunia.com/advisories/28361
http://secunia.com/advisories/29242
http://secunia.com/advisories/30802
http://secunia.com/advisories/33668
http://secunia.com/advisories/36486
http://secunia.com/advisories/44183
http://securityreason.com/securityalert/3011
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://www.vupen.com/english/advisories/2007/2902
http://www.vupen.com/english/advisories/2007/3386
http://www.vupen.com/english/advisories/2007/3527
http://www.vupen.com/english/advisories/2008/1981/references
http://www.vupen.com/english/advisories/2009/0233
https://exchange.xforce.ibmcloud.com/vulnerabilities/35999
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3385


E' possibile lasciare un commento come utenti registrati al sito, accedendo tramite social, account wordpress oppure come utenti anonimi. Nel caso in cui si desideri lasciare un commento come utenti anonimi si verrà avvisati via email di un'eventuale risposta solo se si inserisce l'indirizzo email (facoltativo). L'inserimento di qualsiasi dato nei campi dei commenti è totalmente facoltativo. Chiunque decida di inserire un qualsiasi dato accetta il trattamento di questi ultimi per i fini inerenti al servizio ovvero la risposta al commento e le comunicazioni strettamente necessarie.


Rispondi