The Apache Foundation's Tomcat Java application server is vulnerable to an HTML-based attack. The vulnerability, disclosed Wednesday and updated yesterday, allows remote attackers to inject HTML code into the hostname field of the host manager screen. The resulting code injection could be used to gather up administration cookies, allowing an attacker to take over the system if the operator has enable cookie-based authentication.
Tomcat version 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 are affected by this vulnerability. Tomcat does not check input in the hostname field for cleanliness, and thus allows this injection. As of today, Apache has not released a patch for this vulnerability.
--Alex Handy
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment