Description
- The following problems were fixed in Apache Tomcat version 7.0.30: <br/><br/> <ul> <li> <strong>Important: Bypass of security constraints CVE-2012-3546</strong><br/> When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending /j_security_check to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate(). This was fixed in revision 1377892. </li> <li> <strong>DIGEST authentication weakness CVE-2012-3439</strong><br/> Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:<br/> Tomcat tracked client rather than server nonces and nonce count.<br/> When a session ID was present, authentication was bypassed.<br/> The user name and password were not checked before when indicating that a nonce was stale.<br/> These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances. </li> </ul> <br/><br/><span class="bb-navy">Affected Apache Tomcat versions (7.0.0 - 7.0.31).</span><br/>
Remediation
- Upgrade to the latest version of Apache Tomcat.
References
Severity
Classification
Tags
Related Vulnerabilities