PT-2014-3441 · Apache · Apache Tomcat

Vincent Danen · Published 2014-01-31 · Updated 2022-05-14 · CVE-2014-0033

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.33 through 6.0.37

Description The issue allows remote attackers to conduct session fixation attacks via a crafted URL, because the disableURLRewriting setting is not considered when handling a session ID in a URL. This is due to a regression introduced by previous fixes to path parameter handling, which causes session IDs provided in the URL to be considered even when disableURLRewriting is configured to true. The session is only used for that single request.

Recommendations For Apache Tomcat versions 6.0.33 through 6.0.37, consider setting disableURLRewriting to true and ensure that session IDs are not provided in URLs to minimize the risk of session fixation attacks. As a temporary workaround, restrict the use of session IDs in URLs until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-0033

DLA-91-1

DSA-3530-1

GHSA-6GJJ-C5MJ-4CVP

RHSA-2014:0525

USN-2130-1

Affected Products

Apache Tomcat

References · 70

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119 · Security Note
• http://debian.org/security/2016/dsa-3530 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5345 · Security Note
• https://bdu.fstec.ru/vul/2016-00612 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3530-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0033 · Security Note
• https://security-tracker.debian.org/tracker/source-package/tomcat6 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5346 · Security Note
• https://bdu.fstec.ru/vul/2016-00615 · Security Note
• http://tomcat.apache.org/security-6.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0714 · Security Note
• https://osv.dev/vulnerability/GHSA-6gjj-c5mj-4cvp · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0033 · Security Note
• https://bdu.fstec.ru/vul/2016-00613 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4590 · Security Note