(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host allows remote attackers to determine physical file
layout.\n\nThe remote Jakarta Tomcat server reveals the physical path of the remote
webroot when asked for a .jsp file using a specially crafted request. An attacker may use
this flaw to gain further knowledge about the remote system layout.
Solution: Upgrade to Tomcat 3.2.1 or higher.
CVE-2000-0759
Apache Tomcat < 3.3.1a Directory Listing and File Disclosure
PVS ID: 1466 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:11438
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks\n\nApache Tomcat (prior to 3.3.1a) is prone to a directory listing and file disclosure
vulnerability. An attacker may exploit this bug to get the listing of directories otherwise
protected by an index.html file, or even to get the source code of the remote .jsp scripts.
Solution: Upgrade to Tomcat 3.3.1a or higher.
CVE-2003-0042
Apache Tomcat < 3.3.1a Servlet Engine MS/DOS Device Name DoS
PVS ID: 1467 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:11150
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nIt may
be possible the freeze or crash the remote Tomcat web server by making it read MS/DOS
devices files through its servlet engine (ie: /examples/servlet/AUX).
Solution: Upgrade to Tomcat 3.3.1a or higher.
CVE-2003-0045
thttpd < 2.20 ssi Servlet Traversal File Access
PVS ID: 1468 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:10523
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows attackers to retrieve
sensitive files.\n\nThe remote web server (thttpd) allows an attacker to read arbitrary files
on this host, by exploiting a weakness in an included ssi package, in prepending %2e%2e/
to the pathname (as in GET /cgi-bin/ssi//%2e%2e/%2e%2e/etc/passwd).
Solution: Upgrade to thttpd 2.20 or higher.
CVE-2000-0900
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 378