Note: /etc/tomcat5/web.xml has been updated to disable directory listing by<br>default. If you have previously modified /etc/tomcat5/web.xml, this change<br>will not be made automatically and you should manually update the value for<br>the "listings" parameter to "false". <br>Note: In response to CVE-2007-0450, JBoss AS considers encoded slashes and<br>backslashes in URLs invalid and its usage will result in HTTP 400 error. It<br>is possible to allow encoded slashes and backslashes by following the steps<br>outlined below, however doing so will expose you to CVE-2007-0450 related<br>attacks:<br>a) If you use the /var/lib/jbossas/bin/run.sh setup, please edit <br>/etc/jbossas/run.conf and append<br><li>Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true </li> <li>Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true to the </li> string assigned to JAVA_OPTS<br>b) If you use the init script setup to run multiple JBoss AS services and<br>you wish to allow encoding by default on all services, please edit<br>/etc/jbossas/jbossas.conf and add the line JAVA_OPTS="${JAVA_OPTS}<br><li>Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true </li> <li>Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true" </li> c) If you use the init script setup to run multiple JBoss AS services and<br>want to allow encoding of slashes and backslashes for a particular service,<br>please edit /etc/sysconfig/${NAME} (where NAME is the name of your service)<br>and add the line JAVA_OPTS="${JAVA_OPTS}<br><li>Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true </li> <li>Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true" </li> Before applying this update, make sure that all previously-released<br>errata relevant to your system have been applied.<br>This update is available via Red Hat Network. Details on how to use<br>the Red Hat Network to apply this update are available at<br><a href="http://kbase.redhat.com/faq/FAQ_58_10188" target="_blank">http://kbase.redhat.com/faq/FAQ_58_10188</a>