PT-2007-6763 · Apache · Apache Geronimo

Jarek Gawor · Publicado 2007-11-03 · Atualizado 2011-03-08 · CVE-2007-5797

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Geronimo versions 2.0 through 2.1

Description The issue allows remote attackers to bypass authentication by attempting to log in with any username not contained in the database, as the SQLLoginModule does not throw an exception for a nonexistent username.

Recommendations For Apache Geronimo versions 2.0 through 2.1, consider temporarily restricting access to the SQLLoginModule until a patch is available. As a workaround, monitor login attempts closely to detect and prevent potential unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2007-5797

Produtos afetados

Apache Geronimo

Referências · 9

• https://issues.apache.org/jira/browse/GERONIMO-3543 · Nota
• http://vupen.com/english/advisories/2007/3676 · Nota
• http://securityfocus.com/bid/26287 · Nota
• http://secunia.com/advisories/27482 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-5797 · Nota de Segurança
• http://osvdb.org/38662 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg21286105 · Nota
• http://vupen.com/english/advisories/2007/3675 · Nota
• http://secunia.com/advisories/27478 · Nota