Apache HTTP Server Tomcat远程目录访问漏洞

<a href="https://www.exploit-db.com/exploits/29739" target="_blank">https://www.exploit-db.com/exploits/29739</a><br/> <a href="https://www.securityfocus.com/bid/22960" target="_blank">https://www.securityfocus.com/bid/22960</a><br/> <a href="https://cxsecurity.com/issue/WLB-2007030144" target="_blank">https://cxsecurity.com/issue/WLB-2007030144</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200703-400" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200703-400</a><br/>

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 如果将Apache HTTP服务器和Tomcat配置为与常见的代理模块(mod_proxy、mod_rewrite、mod_jk)交互操作的话，攻击者就可以非授权访问预期目标路径以外的目录，直至Tomcat中的Web根目录。Apache中可接受的唯一目录分隔字符是斜线(/)，但Tomcat允许URI编码的字符，如/、或%5C等，这允许攻击者通过特制的HTTP请求执行访问受保护的文件。

来源:BUGTRAQ
名称:20070314SECConsultSA-20070314-0::ApacheHTTPServer/Tomcatdirectorytraversal
链接:http://www.securityfocus.com/archive/1/archive/1/462791/100/0/threaded
来源:XF
名称:tomcat-proxy-directory-traversal(32988)
链接:http://xforce.iss.net/xforce/xfdb/32988
来源:BID
名称:22960
链接:http://www.securityfocus.com/bid/22960
来源:BUGTRAQ
名称:20090127CA20090123-01:CohesionTomcatMultipleVulnerabilities(Updated-v1.1)
链接:http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
来源:BUGTRAQ
名称:20090124CA20090123-01:CohesionTomcatMultipleVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
来源:MISC
链接:http://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt
来源:MISC
链接:http://www.sec-consult.com/287.html
来源:REDHAT
名称:RHSA-2007:0327
链接:http://www.redhat.com/support/errata/RHSA-2007-0327.html
来源:SUSE
名称:SUSE-SR:2007:005
链接:http://www.novell.com/linux/security/advisories/2007_5_sr.html
来源:VUPEN
名称:ADV-2009-0233
链接:http://www