PT-2011-3680 · Apache+3 · Apache Tomcat+3

Polina Genova · Publicado 2011-06-29 · Atualizado 2022-05-14 · CVE-2011-2204

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.18

Description The issue allows local users to obtain sensitive information by reading a log file when the MemoryUserDatabase is used and errors occur in JMX user creation. This is because log entries contain passwords upon encountering such errors. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users without these permissions but with access to log files may also discover a user's password.

Recommendations For Apache Tomcat versions 5.5.x through 5.5.33, update to version 5.5.34 or later. For Apache Tomcat versions 6.x through 6.0.32, update to version 6.0.33 or later. For Apache Tomcat versions 7.x through 7.0.18, update to version 7.0.19 or later. As a temporary workaround, consider restricting access to log files and the tomcat-users.xml file to minimize the risk of exploitation.

Exploit

Correção

Insertion into Log File

Information Disclosure

Enumeração de Fraquezas

CWE-532

CWE-200

Identificadores relacionados

CESA-2011_1780

CVE-2011-2204

DSA-2401-1

GHSA-C57P-3V2G-W9RG

HPSBUX02725

HPSBUX02860

RHSA-2011:1780

RHSA-2011:1845

RHSA-2011_1780

RHSA-2011_1845

RHSA-2012:0680

RHSA-2012:0682

Produtos afetados

Apache Tomcat

Centos

Hp-Ux

Red Hat

Referências · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/763a56b45999653ce648a18462b8a826809215b1 · Nota
• https://github.com/apache/tomcat55/commit/8b81c8c869987e35deed04993ecfcf7be27ca298 · Nota
• https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E · Nota
• http://marc.info/?l=bugtraq&m=132215163318824&w=2 · Aviso do Fabricante
• http://secunia.com/advisories/57126 · Nota
• http://support.apple.com/kb/HT5130 · Nota
• https://access.redhat.com/errata/RHSA-2011:1845 · Nota