PT-2012-4712 · Apache · Apache Tomcat

CVE-2012-3439 · Publicado 2012-10-19 · Atualizado 2023-02-12

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache Tomcat (affected versions not specified)

Description The issue concerns weaknesses in Tomcat's implementation of DIGEST authentication. Specifically, Tomcat tracked client rather than server nonces and nonce count, which reduced the security of DIGEST authentication. Additionally, when a session ID was present, authentication was bypassed, and the user name and password were not checked before indicating that a nonce was stale. These weaknesses made replay attacks possible in some circumstances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2012-3439

Produtos afetados

Apache Tomcat

Referências · 5

• https://tomcat.apache.org/security-5 · Nota
• https://tomcat.apache.org/security-7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3439 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3439 · Nota
• https://tomcat.apache.org/security-6 · Nota