PT-2007-7437 · Apache · Apache Tomcat

Published 2007-02-08 · Updated 2019-03-25 · CVE-2008-0128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 5.5.21

Description The issue concerns the SingleSignOn Valve in Apache Tomcat, where the JSESSIONIDSSO cookie is not set with the secure flag during an https session. This can cause the cookie to be sent in http requests, making it easier for remote attackers to capture the cookie. Specifically, when using the SingleSignOn Valve via https, the JSESSIONIDSSO cookie is transmitted without the secure attribute, resulting in it being transmitted to any content requested via http from the same server.

Recommendations For versions prior to 5.5.21, update to version 5.5.21 or later to resolve the issue. As a temporary workaround, consider configuring the SingleSignOn Valve to set the secure flag for the JSESSIONIDSSO cookie to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2008-0128

DSA-1468-1

RHSA-2008:0261

RHSA-2008:0524

RHSA-2008:0630

RHSA-2010:0602

Affected Products

Apache Tomcat

References · 27

• http://issues.apache.org/bugzilla/show_bug.cgi?id=41217 · Patch
• http://rhn.redhat.com/errata/RHSA-2008-0630.html · Vendor Advisory
• http://secunia.com/advisories/28549 · Vendor Advisory
• http://debian.org/security/2008/dsa-1468 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html · Vendor Advisory
• http://secunia.com/advisories/28552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0128 · Security Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Note
• http://securityfocus.com/archive/1/500396/100/0/threaded · Note
• http://secunia.com/advisories/29242 · Note
• http://securityfocus.com/archive/1/500412/100/0/threaded · Note
• http://securityfocus.com/bid/27365 · Note
• http://vupen.com/english/advisories/2009/0233 · Note
• http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx · Note