CVE ID:	CVE-2007-3382
Description:	Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
Test IDs:	1.3.6.1.4.1.25623.1.0.59876   1.3.6.1.4.1.25623.1.0.60108   1.3.6.1.4.1.25623.1.0.59877   1.3.6.1.4.1.25623.1.0.60102   1.3.6.1.4.1.25623.1.0.122660
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-3382 AIX APAR: IZ55562 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55562 http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html BugTraq ID: 25316 http://www.securityfocus.com/bid/25316 Bugtraq: 20070814 CVE-2007-3382: Handling of cookies containing a ' character (Google Search) http://www.securityfocus.com/archive/1/476442/100/0/threaded Bugtraq: 20070814 Re: CVE-2007-3382: Handling of cookies containing a ' character (Google Search) http://www.securityfocus.com/archive/1/476466/100/0/threaded Bugtraq: 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/500396/100/0/threaded Bugtraq: 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1) (Google Search) http://www.securityfocus.com/archive/1/500412/100/0/threaded CERT/CC vulnerability note: VU#993544 http://www.kb.cert.org/vuls/id/993544 Debian Security Information: DSA-1447 (Google Search) http://www.debian.org/security/2008/dsa-1447 Debian Security Information: DSA-1453 (Google Search) http://www.debian.org/security/2008/dsa-1453 https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html HPdes Security Advisory: HPSBTU02276 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554 HPdes Security Advisory: HPSBUX02262 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 HPdes Security Advisory: SSRT071447 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 HPdes Security Advisory: SSRT071472 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554 http://www.mandriva.com/security/advisories?name=MDKSA-2007:241 https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11269 RedHat Security Advisories: RHSA-2007:0871 http://www.redhat.com/support/errata/RHSA-2007-0871.html RedHat Security Advisories: RHSA-2007:0950 http://www.redhat.com/support/errata/RHSA-2007-0950.html RedHat Security Advisories: RHSA-2008:0195 http://www.redhat.com/support/errata/RHSA-2008-0195.html RedHat Security Advisories: RHSA-2008:0261 http://www.redhat.com/support/errata/RHSA-2008-0261.html http://securitytracker.com/id?1018556 http://secunia.com/advisories/26466 http://secunia.com/advisories/26898 http://secunia.com/advisories/27037 http://secunia.com/advisories/27267 http://secunia.com/advisories/27727 http://secunia.com/advisories/28317 http://secunia.com/advisories/28361 http://secunia.com/advisories/29242 http://secunia.com/advisories/30802 http://secunia.com/advisories/33668 http://secunia.com/advisories/36486 SuSE Security Announcement: SUSE-SR:2008:005 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html SuSE Security Announcement: SUSE-SR:2009:004 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://www.vupen.com/english/advisories/2007/2902 http://www.vupen.com/english/advisories/2007/3386 http://www.vupen.com/english/advisories/2007/3527 http://www.vupen.com/english/advisories/2008/1981/references http://www.vupen.com/english/advisories/2009/0233 XForce ISS Database: tomcat-quotecookie-information-disclosure(36006) https://exchange.xforce.ibmcloud.com/vulnerabilities/36006