PT-2012-4712 · Apache · Apache Tomcat

Published 2012-10-19 · Updated 2023-02-12 · CVE-2012-3439

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache Tomcat (affected versions not specified)

Description The issue concerns weaknesses in Tomcat's implementation of DIGEST authentication. Specifically, Tomcat tracked client rather than server nonces and nonce count, which reduced the security of DIGEST authentication. Additionally, when a session ID was present, authentication was bypassed, and the user name and password were not checked before indicating that a nonce was stale. These weaknesses made replay attacks possible in some circumstances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2012-3439

Affected Products

Apache Tomcat

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-3439 · Security Note
• https://tomcat.apache.org/security-5 · Note
• https://tomcat.apache.org/security-7 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3439 · Note
• https://tomcat.apache.org/security-6 · Note