Apache Tomcat RequestDispatcher 信息泄露漏洞

<a href="https://www.securityfocus.com/bid/35263" target="_blank">https://www.securityfocus.com/bid/35263</a><br/> <a href="https://cxsecurity.com/issue/WLB-2009060144" target="_blank">https://cxsecurity.com/issue/WLB-2009060144</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200906-265" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200906-265</a><br/>

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Tomcat在使用RequestDispatcher方式过滤查询字符串之前会首先规范化模板路径名称，如果请求中包含有特制参数的话，就可能通过目录遍历攻击访问受限制的内容，或在WEB-INF目录中锁定内容。

来源:VUPEN
名称:ADV-2009-1520
链接:http://www.vupen.com/english/advisories/2009/1520
来源:BID
名称:35263
链接:http://www.securityfocus.com/bid/35263
来源:BUGTRAQ
名称:20090610[SECURITY]UPDATEDCVE-2008-5515RequestDispatcherdirectorytraversalvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/504202/100/0/threaded
来源:BUGTRAQ
名称:20090608[SECURITY]CVE-2008-5515RequestDispatcherdirectorytraversalvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/504170/100/0/threaded
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-6.html
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-5.html
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-4.html
来源:JVN
名称:JVN#63832775
链接:http://jvn.jp/en/jp/JVN63832775/index.html
来源:VUPEN
名称:ADV-2009-1856
链接:http://www.vupen.com/english/advisories/2009/1856
来源:VUPEN
名称:ADV-2009-1535
链接:http://www.vupen.com/english/advisories/2009/1535
来源:MANDRIVA
名称:MDVSA-2009:138
链接:http://www.mandriva.com/security/advisories?name=MDVSA-2009:138