Apache Tomcat Cookie敏感信息泄露漏洞

<a href="https://www.exploit-db.com/exploits/30496" target="_blank">https://www.exploit-db.com/exploits/30496</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200708-217" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200708-217</a><br/>

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。Apache Tomcat没有正确地处理Cookie值中的 字符序列，且错误地将Cookie值中的单引号处理为分隔符，在某些情况下，这可能导致泄露敏感信息，如会话ID。

来源:USGovernmentResource:20070814Re:CVE-2007-3382:Handlingofcookiescontaininga'character
名称:20070814Re:CVE-2007-3382:Handlingofcookiescontaininga'character
链接:http://www.securityfocus.com/archive/1/archive/1/476466/100/0/threaded
来源:US-CERT
名称:VU#993544
链接:http://www.kb.cert.org/vuls/id/993544
来源:BUGTRAQ
名称:20070814CVE-2007-3382:Handlingofcookiescontaininga'character
链接:http://www.securityfocus.com/archive/1/archive/1/476442/100/0/threaded
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-6.html
来源:BUGTRAQ
名称:20090127CA20090123-01:CohesionTomcatMultipleVulnerabilities(Updated-v1.1)
链接:http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
来源:BUGTRAQ
名称:20090124CA20090123-01:CohesionTomcatMultipleVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
来源:VUPEN
名称:ADV-2009-0233
链接:http://www.frsirt.com/english/advisories/2009/0233
来源:VUPEN
名称:ADV-2008-1981
链接:http://www.frsirt.com/english/advisories/2008/1981/references
来源:AIXAPAR