Vulnerability

    tomcat

Affected

    Jakarta-tomcat

Description

    Scott Morris found following.  Jakarta Tomcat contains a  security
    bug  that  can  compromise  UNIX  servers  running Tomcat as root.
    Tomcat can be used together with the Apache web server or a  stand
    alone server for Java Servlets as well as Java Servlet Pages.

    The defaullt intall of Tomcat contains a mounted contest  (/admin)
    that contains servlets  that can be  used to add,  delete, or view
    context information about the Tomcat Server.  Under UNIX, the root
    directory can bee added as a context, and if the server is running
    as root, all files on the system can be viewed over the web.

Solution

    Possible solution:

        1) Do not run the Tomcat server as root
        2) Restrict  access  to  the  /admin  context  or  remove   it
           completely