PT-2011-2926 · Apache+4 · Apache Tomcat+4

Published 2011-08-18 · Updated 2023-02-13 · CVE-2011-1184

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.11

Description The issue concerns the HTTP Digest Access Authentication implementation, which lacks proper countermeasures against replay attacks. This allows remote attackers to bypass access restrictions by sniffing the network for valid requests. The problem is related to the lack of checking of nonce (server nonce) and nc (nonce-count or client nonce count) values.

Recommendations For Apache Tomcat versions 5.5.x through 5.5.33, update to version 5.5.34 or later. For Apache Tomcat versions 6.x through 6.0.32, update to version 6.0.33 or later. For Apache Tomcat versions 7.x through 7.0.11, update to version 7.0.12 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2011_1780

CVE-2011-1184

DSA-2401-1

GHSA-Q9XF-JWR4-V445

HPSBUX02860

OPENSUSE-SU-2012_0208-1

RHSA-2011:1780

RHSA-2011:1845

RHSA-2011_1780

RHSA-2011_1845

RHSA-2012:0074

RHSA-2012:0076

RHSA-2012:0680

RHSA-2012:0682

SUSE-SU-2012_0155-1

Affected Products

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

References · 47

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• https://osv.dev/vulnerability/GHSA-q9xf-jwr4-v445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1184 · Security Note
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0074.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0075.html · Vendor Advisory
• http://tomcat.apache.org/security-5.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0325.html · Vendor Advisory
• http://svn.apache.org/viewvc?view=rev&rev=1159309 · Patch