Apache Tomcat version older than 7.0.30

Description

The following problems were fixed in Apache Tomcat version 7.0.30:

• Important: Bypass of security constraints CVE-2012-3546
  When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending /j_security_check to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate(). This was fixed in revision 1377892.
• DIGEST authentication weakness CVE-2012-3439
  Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:
  Tomcat tracked client rather than server nonces and nonce count.
  When a session ID was present, authentication was bypassed.
  The user name and password were not checked before when indicating that a nonce was stale.
  These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.

Affected Apache Tomcat versions (7.0.0 - 7.0.31).

Remediation

Upgrade to the latest version of Apache Tomcat.

References

Related Vulnerabilities

Severity

High

Classification

CVE-2012-3439 CVE-2012-3544 CVE-2012-3546 CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Tags

Configuration Missing Update