CVE - CVE-2007-5333

CVE-ID
CVE-2007-5333	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:20080208 [SECURITY] CVE-2007-5333: Tomcat Cookie handling vulnerabilities URL:http://www.securityfocus.com/archive/1/487822/100/0/threaded MISC:20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components URL:http://www.securityfocus.com/archive/1/507985/100/0/threaded MISC:27706 URL:http://www.securityfocus.com/bid/27706 MISC:28878 URL:http://secunia.com/advisories/28878 MISC:28884 URL:http://secunia.com/advisories/28884 MISC:28915 URL:http://secunia.com/advisories/28915 MISC:29711 URL:http://secunia.com/advisories/29711 MISC:30676 URL:http://secunia.com/advisories/30676 MISC:30802 URL:http://secunia.com/advisories/30802 MISC:31681 URL:http://www.securityfocus.com/bid/31681 MISC:32036 URL:http://secunia.com/advisories/32036 MISC:32222 URL:http://secunia.com/advisories/32222 MISC:33330 URL:http://secunia.com/advisories/33330 MISC:3636 URL:http://securityreason.com/securityalert/3636 MISC:37460 URL:http://secunia.com/advisories/37460 MISC:44183 URL:http://secunia.com/advisories/44183 MISC:57126 URL:http://secunia.com/advisories/57126 MISC:ADV-2008-0488 URL:~~http://www.vupen.com/english/advisories/2008/0488~~ (Obsolete source) MISC:ADV-2008-1856 URL:~~http://www.vupen.com/english/advisories/2008/1856/references~~ (Obsolete source) MISC:ADV-2008-1981 URL:~~http://www.vupen.com/english/advisories/2008/1981/references~~ (Obsolete source) MISC:ADV-2008-2690 URL:~~http://www.vupen.com/english/advisories/2008/2690~~ (Obsolete source) MISC:ADV-2008-2780 URL:~~http://www.vupen.com/english/advisories/2008/2780~~ (Obsolete source) MISC:ADV-2009-3316 URL:~~http://www.vupen.com/english/advisories/2009/3316~~ (Obsolete source) MISC:APPLE-SA-2008-06-30 URL:http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html MISC:APPLE-SA-2008-10-09 URL:http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html MISC:FEDORA-2008-1467 URL:https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html MISC:FEDORA-2008-1603 URL:https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html MISC:GLSA-200804-10 URL:http://security.gentoo.org/glsa/glsa-200804-10.xml MISC:HPSBST02955 URL:http://marc.info/?l=bugtraq&m=139344343412337&w=2 MISC:IZ20133 URL:http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20133 MISC:IZ20991 URL:http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20991 MISC:JVN#09470767 URL:http://jvn.jp/jp/JVN%2309470767/index.html MISC:MDVSA-2009:018 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2009:018~~ (Obsolete source) MISC:MDVSA-2010:176 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2010:176~~ (Obsolete source) MISC:SUSE-SR:2009:004 URL:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html MISC:[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ URL:https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E MISC:[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ URL:https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E MISC:[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ URL:https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E MISC:[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ URL:https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E MISC:[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ URL:https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E MISC:[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ URL:https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E MISC:[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ URL:https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E MISC:http://support.apple.com/kb/HT2163 URL:http://support.apple.com/kb/HT2163 MISC:http://support.apple.com/kb/HT3216 URL:http://support.apple.com/kb/HT3216 MISC:http://tomcat.apache.org/security-4.html URL:http://tomcat.apache.org/security-4.html MISC:http://tomcat.apache.org/security-5.html URL:http://tomcat.apache.org/security-5.html MISC:http://tomcat.apache.org/security-6.html URL:http://tomcat.apache.org/security-6.html MISC:http://www-01.ibm.com/support/docview.wss?uid=swg24018932 URL:http://www-01.ibm.com/support/docview.wss?uid=swg24018932 MISC:http://www-01.ibm.com/support/docview.wss?uid=swg27012047 URL:http://www-01.ibm.com/support/docview.wss?uid=swg27012047 MISC:http://www-01.ibm.com/support/docview.wss?uid=swg27012048 URL:http://www-01.ibm.com/support/docview.wss?uid=swg27012048 MISC:http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html URL:http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html MISC:http://www.vmware.com/security/advisories/VMSA-2008-0010.html URL:http://www.vmware.com/security/advisories/VMSA-2008-0010.html MISC:http://www.vmware.com/security/advisories/VMSA-2009-0016.html URL:http://www.vmware.com/security/advisories/VMSA-2009-0016.html MISC:https://bugzilla.redhat.com/show_bug.cgi?id=532111 URL:https://bugzilla.redhat.com/show_bug.cgi?id=532111 MISC:oval:org.mitre.oval:def:11177 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11177
Assigning CNA
Red Hat, Inc.
Date Record Created
20071010	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20071010)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)