PT-2011-2926 · Apache+4 · Apache Tomcat+4

Publicado 2011-08-18 · Atualizado 2023-02-13 · CVE-2011-1184

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.11

Description The issue concerns the HTTP Digest Access Authentication implementation, which lacks proper countermeasures against replay attacks. This allows remote attackers to bypass access restrictions by sniffing the network for valid requests. The problem is related to the lack of checking of nonce (server nonce) and nc (nonce-count or client nonce count) values.

Recommendations For Apache Tomcat versions 5.5.x through 5.5.33, update to version 5.5.34 or later. For Apache Tomcat versions 6.x through 6.0.32, update to version 6.0.33 or later. For Apache Tomcat versions 7.x through 7.0.11, update to version 7.0.12 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2011_1780

CVE-2011-1184

DSA-2401-1

GHSA-Q9XF-JWR4-V445

HPSBUX02860

OPENSUSE-SU-2012_0208-1

RHSA-2011:1780

RHSA-2011:1845

RHSA-2011_1780

RHSA-2011_1845

RHSA-2012:0074

RHSA-2012:0076

RHSA-2012:0680

RHSA-2012:0682

SUSE-SU-2012_0155-1

Produtos afetados

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

Referências · 47

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/639e20992a66d7a42fb59c974db91c8a0f730a1e · Nota
• https://github.com/apache/tomcat55/commit/644dfdf96cf82fcd2a2046d93f2b5495f7e94584 · Nota
• https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1184 · Nota
• https://osv.dev/vulnerability/GHSA-q9xf-jwr4-v445 · Aviso do Fabricante
• http://secunia.com/advisories/57126 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1184 · Nota de Segurança