Description
The following problems were fixed in Apache Tomcat version 7.0.30:
-
Important: Bypass of security constraints CVE-2012-3546
When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending /j_security_check to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate(). This was fixed in revision 1377892. -
DIGEST authentication weakness CVE-2012-3439
Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:
Tomcat tracked client rather than server nonces and nonce count.
When a session ID was present, authentication was bypassed.
The user name and password were not checked before when indicating that a nonce was stale.
These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.
Affected Apache Tomcat versions (7.0.0 - 7.0.31).
Remediation
Upgrade to the latest version of Apache Tomcat.
References
Related Vulnerabilities
WordPress Plugin Pay Per Media Player Multiple Cross-Site Scripting Vulnerabilities (1.24)
WordPress Plugin Power Charts-Responsive Beautiful Charts & Graphs Cross-Site Scripting (0.1.0)
WordPress Plugin AdRotate-Ad manager & AdSense Ads 'adrotate-out.php' SQL Injection (3.6.6)