Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E [No Types Assigned]

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E [No Types Assigned]

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E [No Types Assigned]

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E [Mailing List, Vendor Advisory]

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E [Mailing List, Vendor Advisory]

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E [Mailing List, Vendor Advisory]

OR
     *cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*

OR
     *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (including) 4.1.37
     *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 5.0.0 up to (including) 5.5.26
     *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (including) 6.0.16

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html No Types Assigned

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html Third Party Advisory

http://marc.info/?l=bugtraq&m=123376588623823&w=2 No Types Assigned

http://marc.info/?l=bugtraq&m=123376588623823&w=2 Third Party Advisory

http://secunia.com/advisories/31639 No Types Assigned

http://secunia.com/advisories/31639 Broken Link

http://secunia.com/advisories/31865 No Types Assigned

http://secunia.com/advisories/31865 Broken Link

http://secunia.com/advisories/31891 No Types Assigned

http://secunia.com/advisories/31891 Broken Link

http://secunia.com/advisories/31982 No Types Assigned

http://secunia.com/advisories/31982 Broken Link

http://secunia.com/advisories/32120 No Types Assigned

http://secunia.com/advisories/32120 Broken Link

http://secunia.com/advisories/32222 No Types Assigned

http://secunia.com/advisories/32222 Broken Link

http://secunia.com/advisories/32266 No Types Assigned

http://secunia.com/advisories/32266 Broken Link

http://secunia.com/advisories/33797 No Types Assigned

http://secunia.com/advisories/33797 Broken Link

http://secunia.com/advisories/37297 No Types Assigned

http://secunia.com/advisories/37297 Broken Link

http://securityreason.com/securityalert/4148 No Types Assigned

http://securityreason.com/securityalert/4148 Third Party Advisory

http://support.apple.com/kb/HT3216 No Types Assigned

http://support.apple.com/kb/HT3216 Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm No Types Assigned

http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm Third Party Advisory

http://tomcat.apache.org/security-4.html No Types Assigned

http://tomcat.apache.org/security-4.html Vendor Advisory

http://tomcat.apache.org/security-5.html No Types Assigned

http://tomcat.apache.org/security-5.html Vendor Advisory

http://tomcat.apache.org/security-6.html Patch

http://tomcat.apache.org/security-6.html Vendor Advisory

http://www.kb.cert.org/vuls/id/343355 US Government Resource

http://www.kb.cert.org/vuls/id/343355 Third Party Advisory, US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 No Types Assigned

http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0648.html No Types Assigned

http://www.redhat.com/support/errata/RHSA-2008-0648.html Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0862.html No Types Assigned

http://www.redhat.com/support/errata/RHSA-2008-0862.html Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0864.html No Types Assigned

http://www.redhat.com/support/errata/RHSA-2008-0864.html Third Party Advisory

http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt No Types Assigned

http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt Third Party Advisory

http://www.securityfocus.com/archive/1/495318/100/0/threaded No Types Assigned

http://www.securityfocus.com/archive/1/495318/100/0/threaded Third Party Advisory, VDB Entry

http://www.securityfocus.com/archive/1/507729/100/0/threaded No Types Assigned

http://www.securityfocus.com/archive/1/507729/100/0/threaded Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/30633 No Types Assigned

http://www.securityfocus.com/bid/30633 Third Party Advisory, VDB Entry

http://www.securityfocus.com/bid/31681 No Types Assigned

http://www.securityfocus.com/bid/31681 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id?1020665 No Types Assigned

http://www.securitytracker.com/id?1020665 Third Party Advisory, VDB Entry

http://www.vupen.com/english/advisories/2008/2343 No Types Assigned

http://www.vupen.com/english/advisories/2008/2343 Third Party Advisory

http://www.vupen.com/english/advisories/2008/2780 No Types Assigned

http://www.vupen.com/english/advisories/2008/2780 Third Party Advisory

http://www.vupen.com/english/advisories/2008/2823 No Types Assigned

http://www.vupen.com/english/advisories/2008/2823 Third Party Advisory

http://www.vupen.com/english/advisories/2009/0320 No Types Assigned

http://www.vupen.com/english/advisories/2009/0320 Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/44411 No Types Assigned

https://exchange.xforce.ibmcloud.com/vulnerabilities/44411 Third Party Advisory, VDB Entry

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E No Types Assigned

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E Mailing List, Vendor Advisory

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E No Types Assigned

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E Mailing List, Vendor Advisory

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E No Types Assigned

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E Mailing List, Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10587 No Types Assigned

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10587 Tool Signature

https://www.exploit-db.com/exploits/6229 No Types Assigned

https://www.exploit-db.com/exploits/6229 Third Party Advisory, VDB Entry

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html No Types Assigned

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html No Types Assigned

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html No Types Assigned

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html Third Party Advisory

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E [No Types Assigned]

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E [No Types Assigned]

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E [No Types Assigned]

http://www.securityfocus.com/archive/1/495318/100/0/threaded [No Types Assigned]

http://www.securityfocus.com/archive/1/507729/100/0/threaded [No Types Assigned]

http://www.securityfocus.com/archive/1/archive/1/495318/100/0/threaded [No Types Assigned]

http://www.securityfocus.com/archive/1/archive/1/507729/100/0/threaded [No Types Assigned]

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10587 [No Types Assigned]

https://www.exploit-db.com/exploits/6229 [No Types Assigned]

http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10587 [No Types Assigned]

http://www.milw0rm.com/exploits/6229 [Exploit]

https://exchange.xforce.ibmcloud.com/vulnerabilities/44411 [No Types Assigned]

http://xforce.iss.net/xforce/xfdb/44411 [No Types Assigned]