Bug#380361: tomcat5: CVE-2006-3835: remote directory listing

[Alec Berryman]

Package: tomcat5
Severity: serious
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2006-3835: "Apache Tomcat 5 before 5.5.17 allows remote attackers to
list directories via a semicolon (;) preceding a filename with a mapped
extension, as demonstrated by URLs ending with /;index.jsp and
/;help.do."

The original report to full-disclosure [1] indicates that the 5.0.x
series is also affected.  The reporter claims to have verified it with
5.0.28; I have not tried to reproduce it with Debian's 5.0.30.

Please mention the CVE in your changelog.

Thanks,

Alec

[1] http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0467.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEy28UAud/2YgchcQRAn/cAKCOlXEy+3bcG3yIrx4oRwuMGmuYKACgtf6c
ota7g+uR5br2mvfZRoHicAo=
=DH9m
-----END PGP SIGNATURE-----