PT-2011-3680 · Apache+3 · Apache Tomcat+3

Polina Genova · Published 2011-06-29 · Updated 2022-05-14 · CVE-2011-2204

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.18

Description The issue allows local users to obtain sensitive information by reading a log file when the MemoryUserDatabase is used and errors occur in JMX user creation. This is because log entries contain passwords upon encountering such errors. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users without these permissions but with access to log files may also discover a user's password.

Recommendations For Apache Tomcat versions 5.5.x through 5.5.33, update to version 5.5.34 or later. For Apache Tomcat versions 6.x through 6.0.32, update to version 6.0.33 or later. For Apache Tomcat versions 7.x through 7.0.18, update to version 7.0.19 or later. As a temporary workaround, consider restricting access to log files and the tomcat-users.xml file to minimize the risk of exploitation.

Exploit

Fix

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

CESA-2011_1780

CVE-2011-2204

DSA-2401-1

GHSA-C57P-3V2G-W9RG

HPSBUX02725

HPSBUX02860

RHSA-2011:1780

RHSA-2011:1845

RHSA-2011_1780

RHSA-2011_1845

RHSA-2012:0680

RHSA-2012:0682

Affected Products

Apache Tomcat

Centos

Hp-Ux

Red Hat

References · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• http://marc.info/?l=bugtraq&m=132215163318824&w=2 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=136485229118404&w=2 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133469267822771&w=2 · Vendor Advisory
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c57p-3v2g-w9rg · Vendor Advisory
• http://tomcat.apache.org/security-5.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1845.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2204 · Security Note