This update of tomcat6 fixes the following security issues :

  - denial of service. (CVE-2012-4534)

  - tomcat: HTTP NIO connector OOM DoS via a request with     large headers. (CVE-2012-2733)

  - tomcat: cnonce tracking weakness. (CVE-2012-5885)

  - tomcat: authentication caching weakness. (CVE-2012-5886)

  - tomcat: stale nonce weakness. (CVE-2012-5887)

  - tomcat: affected by slowloris DoS. (CVE-2012-5568)

  - tomcat: Bypass of security constraints. (CVE-2012-3546)

  - tomcat: bypass of CSRF prevention filter.
    (CVE-2012-4431)

The remote Solaris system is missing necessary patches to address security updates :

  - java/org/apache/coyote/http11/InternalNioInputBuffer.jav     a in the HTTP NIO connector in Apache Tomcat 6.x before     6.0.36 and 7.x before 7.0.28 does not properly restrict     the request-header size, which allows remote attackers     to cause a denial of service (memory consumption) via a     large amount of header data. (CVE-2012-2733)

  - org/apache/catalina/realm/RealmBase.java in Apache     Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when     FORM authentication is used, allows remote attackers to     bypass security-constraint checks by leveraging a     previous setUserPrincipal call and then placing     /j_security_check at the end of a URI. (CVE-2012-3546)

  - org/apache/catalina/filters/CsrfPreventionFilter.java in     Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32     allows remote attackers to bypass the cross-site request     forgery (CSRF) protection mechanism via a request that     lacks a session identifier. (CVE-2012-4431)

  - org/apache/tomcat/util/net/NioEndpoint.java in Apache     Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the     NIO connector is used in conjunction with sendfile and     HTTPS, allows remote attackers to cause a denial of     service (infinite loop) by terminating the connection     during the reading of a response. (CVE-2012-4534)

  - The replay-countermeasure functionality in the HTTP     Digest Access Authentication implementation in Apache     Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x     before 7.0.30 tracks cnonce (aka client nonce) values     instead of nonce (aka server nonce) and nc (aka     nonce-count) values, which makes it easier for remote     attackers to bypass intended access restrictions by     sniffing the network for valid requests, a different     vulnerability than CVE-2011-1184. (CVE-2012-5885)

  - The HTTP Digest Access Authentication implementation in     Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36,     and 7.x before 7.0.30 caches information about the     authenticated user within the session state, which makes     it easier for remote attackers to bypass authentication     via vectors related to the session ID. (CVE-2012-5886)

  - The HTTP Digest Access Authentication implementation in     Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36,     and 7.x before 7.0.30 does not properly check for stale     nonce values in conjunction with enforcement of proper     credentials, which makes it easier for remote attackers     to bypass intended access restrictions by sniffing the     network for valid requests. (CVE-2012-5887)

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.36. It is, therefore, affected by the following vulnerabilities :

  - Replay-countermeasure functionality in HTTP Digest     Access Authentication tracks cnonce values instead of     nonce values, which makes it easier for attackers to     bypass access restrictions by sniffing the network for     valid requests.  (CVE-2012-5885)

  - HTTP Digest Access Authentication implementation caches     information about the authenticated user, which could     potentially allow an attacker to bypass authentication     via session ID. (CVE-2012-5886)

  - HTTP Digest Access Authentication implementation does     not properly check for stale nonce values with     enforcement of proper credentials,	which allows an     attacker to bypass restrictions by sniffing requests.
    (CVE-2012-5887)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0631 advisory.

    JBoss Web is a web container based on Apache Tomcat. It provides a single     deployment platform for the JavaServer Pages (JSP) and Java Servlet     technologies.

    Multiple weaknesses were found in the JBoss Web DIGEST authentication     implementation, effectively reducing the security normally provided by     DIGEST authentication. A remote attacker could use these flaws to perform     replay attacks in some circumstances. (CVE-2012-5885, CVE-2012-5886,     CVE-2012-5887)

    Warning: Before applying this update, back up your existing JBoss     Enterprise Web Platform installation (including all applications and     configuration files).

    All users of JBoss Enterprise Web Platform 5.2.0 on Red Hat Enterprise     Linux 4, 5, and 6 are advised to upgrade to these updated packages. The     JBoss server process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- fix bnc#793394 - bypass of security constraints     (CVE-2012-3546)

  - apache-tomcat-CVE-2012-3546.patch     http://svn.apache.org/viewvc?view=revision&revision=1381     035

  - fix bnc#793391 - bypass of CSRF prevention filter     (CVE-2012-4431)

  - apache-tomcat-CVE-2012-4431.patch     http://svn.apache.org/viewvc?view=revision&revision=1394     456

  - document how to protect against slowloris DoS     (CVE-2012-5568/bnc#791679) in README.SUSE

  - fixes bnc#791423 - cnonce tracking weakness     (CVE-2012-5885) bnc#791424 - authentication caching     weakness (CVE-2012-5886) bnc#791426 - stale nonce     weakness (CVE-2012-5887)

  -     apache-tomcat-CVE-2009-2693-CVE-2009-2901-CVE-2009-2902.
    patch     http://svn.apache.org/viewvc?view=revision&revision=1380     829

  - fix bnc#789406 - HTTP NIO connector OOM DoS via a     request with large headers (CVE-2012-2733)

  - http://svn.apache.org/viewvc?view=revision&revision=1356208

This update of tomcat5 fixed the following security issues :

  - tomcat: cnonce tracking weakness. (CVE-2012-5885)

  - tomcat: stale nonce weakness. (CVE-2012-5887)

  - tomcat: authentication caching weakness. (CVE-2012-5886)

  - tomcat: affected by slowloris DoS. (CVE-2012-5568)

  - tomcat: Bypass of security constraints. (CVE-2012-3546)

ID	名稱	產品	系列	已發布	已更新	嚴重性
64430	SuSE 11.2 Security Update : tomcat6 (SAT Patch Number 7208)	Nessus	SuSE Local Security Checks	2013/2/4	2021/1/19	medium
80791	Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_apache_tomcat3)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
62986	Apache Tomcat 5.5.x < 5.5.36 DIGEST Authentication Multiple Security Weaknesses	Nessus	Web Servers	2012/11/21	2024/5/6	medium
234426	RHEL 6 : jbossweb (RHSA-2013:0631)	Nessus	Red Hat Local Security Checks	2025/4/15	2025/4/15	medium
74854	openSUSE Security Update : tomcat6 (openSUSE-SU-2012:1700-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
64431	SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 8397)	Nessus	SuSE Local Security Checks	2013/2/4	2021/1/19	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium