Apache Tomcat远程目录 'index.jsp'信息泄露漏洞

<a href="https://www.exploit-db.com/exploits/28254" target="_blank">https://www.exploit-db.com/exploits/28254</a><br/> <a href="https://www.securityfocus.com/bid/19106" target="_blank">https://www.securityfocus.com/bid/19106</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200607-442" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200607-442</a><br/>

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat的初始配置允许在目录下没有index.jsp之类的欢迎文件时列出目录下的文件列表，远程攻击者可能利用这个问题列出没有配置好的服务器的某些目录下的文件列表，导致敏感信息泄露。

来源:FULLDISC
名称:20060721DirectoryListinginApacheTomcat5.x.x
链接:http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0467.html
来源:XF
名称:apache-tomcat-url-information-disclosure(27902)
链接:http://xforce.iss.net/xforce/xfdb/27902
来源:BID
名称:19106
链接:http://www.securityfocus.com/bid/19106
来源:BUGTRAQ
名称:20090127CA20090123-01:CohesionTomcatMultipleVulnerabilities(Updated-v1.1)
链接:http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
来源:BUGTRAQ
名称:20090124CA20090123-01:CohesionTomcatMultipleVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
来源:VUPEN
名称:ADV-2009-0233
链接:http://www.frsirt.com/english/advisories/2009/0233
来源:support.ca.com
链接:http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
来源:SECTRACK
名称:1016576
链接:http://securitytracker.com/id?1016576
来源:SECUNIA
名称:33668
链接:http://secunia.com/advisories/33668
来源:SUSE
名称:SUSE-SR:2009:004
链接:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg0000