PT-2012-6166 · Apache+4 · Apache Tomcat+4

Publicado 2012-11-17 · Atualizado 2022-05-17 · CVE-2012-5885

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.35 Apache Tomcat versions 6.x through 6.0.35 Apache Tomcat versions 7.x through 7.0.29

Description The issue in the HTTP Digest Access Authentication implementation makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. This is due to the replay-countermeasure functionality tracking cnonce (client nonce) values instead of nonce (server nonce) and nc (nonce-count) values.

Recommendations For Apache Tomcat versions 5.5.x through 5.5.35, update to version 5.5.36 or later. For Apache Tomcat versions 6.x through 6.0.35, update to version 6.0.36 or later. For Apache Tomcat versions 7.x through 7.0.29, update to version 7.0.30 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-264

CWE-284

Identificadores relacionados

CESA-2013_0623

CVE-2012-5885

GHSA-99RF-92V6-CWX4

HPSBUX02860

HPSBUX02866

RHSA-2013:0266

RHSA-2013:0623

RHSA-2013:0629

RHSA-2013:0631

RHSA-2013:0640

RHSA-2013:0647

RHSA-2013_0623

RHSA-2013_0640

Produtos afetados

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

Referências · 90

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/mpgn/CRIME-poc · Exploit
• https://github.com/anthophilee/A2SV--SSL-VUL-Scan · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3546 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2013-0726.html · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2013-0623.html · Aviso do Fabricante
• http://secunia.com/advisories/51371 · Nota
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2012-3546 · Nota