PT-2012-6166 · Apache+4 · Apache Tomcat+4

Published 2012-11-17 · Updated 2022-05-17 · CVE-2012-5885

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.35 Apache Tomcat versions 6.x through 6.0.35 Apache Tomcat versions 7.x through 7.0.29

Description The issue in the HTTP Digest Access Authentication implementation makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. This is due to the replay-countermeasure functionality tracking cnonce (client nonce) values instead of nonce (server nonce) and nc (nonce-count) values.

Recommendations For Apache Tomcat versions 5.5.x through 5.5.35, update to version 5.5.36 or later. For Apache Tomcat versions 6.x through 6.0.35, update to version 6.0.36 or later. For Apache Tomcat versions 7.x through 7.0.29, update to version 7.0.30 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

CESA-2013_0623

CVE-2012-5885

GHSA-99RF-92V6-CWX4

HPSBUX02860

HPSBUX02866

RHSA-2013:0266

RHSA-2013:0623

RHSA-2013:0629

RHSA-2013:0631

RHSA-2013:0640

RHSA-2013:0647

RHSA-2013_0623

RHSA-2013_0640

Affected Products

Apache Tomcat

Centos

Hp-Ux

Red Hat

Suse

References · 90

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/mpgn/CRIME-poc · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3546 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0726.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0623.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5886 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0640.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5887 · Security Note