Patchfirst
Patchfirst
CVE-2007-5333 Public exploit EPSS 62.6%

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double…

Summary

The flaw is in Apache Tomcat, versions 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36, where cookie values containing double quote characters or encoded backslash (%5C) sequences are not properly handled. An attacker who can get a victim's browser to send or expose such a cookie may be able to leak sensitive information such as session IDs and hijack sessions.

Official description · CVE.org

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

Breakdown
24.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Exploit-DB) was available 3 days before disclosure.

  1. Public exploit codeExploit-DB3 days before
  2. Disclosedday 0

A fix was bypassed or incomplete once over 6 months. The latest fix listed for tomcat is 6.0.18.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2007-3385Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0…14 Aug 2007
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
    • Similar weakness in the same product (machine-matched)same package + description similarity
    This CVECVE-2007-5333Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0…12 Feb 2008

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 5.5.21CVE-2008-430826 Feb 2009
  2. 6.0.10CVE-2007-045016 Mar 2007
  3. 6.0.14CVE-2007-245014 Jun 2007
  4. 6.0.15CVE-2007-533312 Feb 2008
  5. 6.0.16CVE-2008-000212 Feb 2008
  6. 6.0.17CVE-2008-12324 Aug 2008
  7. 6.0.18CVE-2008-19474 Jun 2008
  8. 6.0.18CVE-2008-23704 Aug 2008Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-cww4-vj5r-rx57

Upgrade to 6.0.35 or later

Fixes this CVE and 8 other known vulnerabilities in this package (CVE-2007-0450, CVE-2007-2449, +6).

Set the version to 6.0.35 or later in your pom.xml or build.gradle.

First fixed in 6.0.15 for CVE-2007-5333.

Affected versions, by release line

If you runUpgrade to
6.0.0 up to 6.0.156.0.35first fix for this CVE: 6.0.15
5.5.0 up to 5.5.265.5.35first fix for this CVE: 5.5.26
4.1.0 up to 4.1.374.1.40first fix for this CVE: 4.1.37

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

55 links, grouped by NVD tag

vdb-entry 9

vupen.com/english/advisories/2008/2690securityfocus.com/bid/27706vupen.com/english/advisories/2008/1981/referencesoval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11177securityfocus.com/bid/31681vupen.com/english/advisories/2008/0488vupen.com/english/advisories/2008/1856/referencesvupen.com/english/advisories/2008/2780vupen.com/english/advisories/2009/3316

third-party-advisory 14

secunia.com/advisories/33330secunia.com/advisories/30676securityreason.com/securityalert/3636jvn.jp/jp/JVN%2309470767/index.htmlsecunia.com/advisories/28915secunia.com/advisories/37460secunia.com/advisories/28884secunia.com/advisories/28878
Show 6 moreShow fewersecunia.com/advisories/32036secunia.com/advisories/44183secunia.com/advisories/57126secunia.com/advisories/32222secunia.com/advisories/30802secunia.com/advisories/29711

x_refsource_CONFIRM 12

tomcat.apache.org/security-4.htmlsupport.apple.com/kb/HT2163vmware.com/security/advisories/VMSA-2009-0016.htmlwww-01.ibm.com/support/docview.wss?uid=swg27012048redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.htmltomcat.apache.org/security-6.htmlwww-01.ibm.com/support/docview.wss?uid=swg27012047vmware.com/security/advisories/VMSA-2008-0010.html
Show 4 moreShow fewertomcat.apache.org/security-5.htmlsupport.apple.com/kb/HT3216www-01.ibm.com/support/docview.wss?uid=swg24018932bugzilla.redhat.com/show_bug.cgi?id=532111

vendor-advisory 11

www-1.ibm.com/support/docview.wss?uid=swg1IZ20133www-1.ibm.com/support/docview.wss?uid=swg1IZ20991lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlmandriva.com/security/advisories?name=MDVSA-2010:176lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlmandriva.com/security/advisories?name=MDVSA-2009:018redhat.com/archives/fedora-package-announce/2008-February/msg00315.htmlsecurity.gentoo.org/glsa/glsa-200804-10.xml
Show 3 moreShow fewerredhat.com/archives/fedora-package-announce/2008-February/msg00460.htmlmarc.info/?l=bugtraq&m=139344343412337&w=2lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

mailing-list 9

securityfocus.com/archive/1/487822/100/0/threadedsecurityfocus.com/archive/1/507985/100/0/threadedlists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
↑ ↓ chooseEnter openEsc close