Index of /dist/tomcat/tomcat-3/src

Icon  Name                                     Last modified      Size  Description
[PARENTDIR] Parent Directory - [   ] jakarta-servletapi-src.tar.gz 2003-09-06 18:33 64K [TXT] jakarta-servletapi-src.tar.gz.asc 2003-09-06 18:33 477 [   ] jakarta-servletapi-src.zip 2003-09-06 18:33 129K [TXT] jakarta-servletapi-src.zip.asc 2003-09-06 18:33 477 [   ] jakarta-tomcat-3.3.1a-changes.tar.gz 2003-09-06 18:33 21K [TXT] jakarta-tomcat-3.3.1a-changes.tar.gz.asc 2003-09-06 18:33 477 [   ] jakarta-tomcat-3.3.1a-changes.zip 2003-09-06 18:33 31K [TXT] jakarta-tomcat-3.3.1a-changes.zip.asc 2003-09-06 18:33 477 [   ] jakarta-tomcat-3.3.1a-src.tar.gz 2003-09-06 18:33 2.1M [TXT] jakarta-tomcat-3.3.1a-src.tar.gz.asc 2003-09-06 18:33 477 [   ] jakarta-tomcat-3.3.1a-src.zip 2003-09-06 18:33 3.0M [TXT] jakarta-tomcat-3.3.1a-src.zip.asc 2003-09-06 18:33 477
Apache Tomcat 3.3.1a - Source Distributions

Apache Tomcat 3.3.1a - Source Distributions

This directory contains the source distributions for Tomcat 3.3.1a, which is a patched relase of Tomcat 3.3.1 Final.

Tomcat 3.3.1a is a security release that fixes the following vulnerabilities:

For instructions on how to patch an existing Tomcat 3.3.1 installation, see the Binary Distributions directory.


Security Vunlerabilities Fixed in Tomcat 3.3.1a:

Vulnerability where, when used with JDK 1.3.1 or earlier, a maliciously crafted request could return a directory listing even when an index.html, index.jsp, or other welcome file is present. File contents can be returned as well. If you are using Tomcat 3.3.1 or earlier with JDK 1.3.1 or earlier, you should either upgrade to JDK 1.4 or later, or upgrade your Tomcat installation to Tomcat 3.3.1a

Vulnerability where a malicious web application could read the contents of some files outside the web application via its web.xml file in spite of the presence of a security manager. The content of files that can be read as part of an XML document would be accessible. If you are running Tomcat 3.3.1 or earlier with a security manager, and are serving web applications whose web.xml content is not known to be safe, you should upgrade your Tomcat installation to 3.3.1a.

A set of the changed source files and their compiled classes may be found in jakarta-tomcat-3.3.1a-changes.tar.gz and jakarta-tomcat-3.3.1a-changes.zip.

Note: Only classes that required modification have be updated. Thus, the string that identifies the Tomcat version has not been updated. It will still indicate Tomcat 3.3.1 Final.


Important Security Note:
Cross Site scripting security vulnerabilities exist in the 'examples' and 'ROOT' web applications which are distributed along with Apache Tomcat 3.3.1a and earlier Tomcat 3 versions. No other components of Tomcat 3 are currently known to be vulnerable to cross site scripting.

To address this security issue, administrators of public servers which have deployed any Apache Tomcat 3 version should make sure the 'examples' webapp is removed from the deployed Tomcat installation. Also, SnoopServlet.class should be removed from the 'ROOT' web application if still present in the installation.

These vulnerabilities will be removed from Tomcat 3.3.2 prior to release.

Background information on cross site scripting: This allows a mailicious website to execute JavaScript code using the security policy of a trusted domain.
More information: http://httpd.apache.org/info/css-security/


Other portions of the release include:

Note: The jakarta-servletapi source is included here for completeness. It is not required for building Tomcat 3.3.1 from source.

Documentation of what is different between Tomcat 3.3(a) and Tomcat 3.3.1a may be found here.

You may find online documentation for Tomcat 3.3.1 here.

Note: The tar files in this distribution use GNU tar extensions, and must be untarred with a GNU compatible version of tar. The version of tar on Solaris and Mac OS X will not work with these files.