(PVS) Signatures - Tenable Network Security

Apache Tomcat /status Information Disclosure
PVS ID: 1462 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:11218
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote host is running the Tomcat web server, with the /status special page
set. By requesting this URI, an attacker may obtain information about the status of the
remote host and may also be able to reset the statistics of the server.
Solution: If you do not use this feature, comment out the appropriate section in your httpd.conf file. If
you really need it, limit access to the administrator's host.
CVE Not available
Apache Tomcat < 4.x JSP Source Code Disclosure
PVS ID: 1463 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:11176
Description: Synopsis :\n\nThe remote web server can disclose source code.\n\nTomcat 4.0.4 and 4.1.10
(and possibly earlier versions) are vulnerable to source code disclosure by using the default
servlet org.apache.catalina.servlets.DefaultServlet
Solution: Upgrade to version 4.0.5, 4.1.12 or higher
CVE-2002-1148
Apache Tomcat Snoop Servlet Remote Information Disclosure
PVS ID: 1464 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10478
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote Tomcat server has the 'snoop' servlet installed. This servlet
discloses valuable information about the remote host, such as the server type and version,
the PATHs in use, and the kernel version of the remote host. An attacker may use this
information to gain intimate knowledge about this host and make more precise attacks
against it.
Solution: Delete this servlet
CVE-2000-0760
Jakarta Tomcat < 3.2.1 Path Disclosure
PVS ID: 1465 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:10807
Family Internet Services 377