Bugzilla – Bug 735343
VUL-1: CVE-2011-1184: tomcat: Multiple weaknesses in HTTP DIGEST
Last modified: 2014-07-17 09:48:07 UTC
"The implementation of HTTP DIGEST authentication was discovered to have several weaknesses: - - replay attacks were permitted - - server nonces were not checked - - client nonce counts were not checked - - qop values were not checked - - realm values were not checked - - the server secret was hard-coded to a known string The result of these weaknesses is that DIGEST authentication was only as secure as BASIC authentication.", More references can be found here: http://www.securityfocus.com/archive/1/519818/30/0/threaded
CVE-2011-1184
There are actually more bugs in tomcat belonging to authentication digests, so above CVE is not the only one. Descriptions follow.
Name: CVE-2011-5062 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, +and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended +integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. Reference: CONFIRM: http://tomcat.apache.org/security-7.html Reference: CONFIRM: http://tomcat.apache.org/security-6.html Reference: CONFIRM: http://tomcat.apache.org/security-5.html Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1159309 Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1158180 Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1087655
Name: CVE-2011-5063 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, +and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended +access restrictions by leveraging the availability of a protection space with weaker authentication or +authorization requirements, a different vulnerability than CVE-2011-1184. Reference: CONFIRM: http://tomcat.apache.org/security-7.html Reference: CONFIRM: http://tomcat.apache.org/security-6.html Reference: CONFIRM: http://tomcat.apache.org/security-5.html Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1159309 Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1158180 Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1087655
Name: CVE-2011-5064 DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x +before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka +private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by +leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. Reference: CONFIRM: http://tomcat.apache.org/security-7.html Reference: CONFIRM: http://tomcat.apache.org/security-6.html Reference: CONFIRM: http://tomcat.apache.org/security-5.html Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1159309 Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1158180 Reference: CONFIRM: http://svn.apache.org/viewvc?view=rev&rev=1087655
*** Bug 741530 has been marked as a duplicate of this bug. ***
*** Bug 741531 has been marked as a duplicate of this bug. ***
*** Bug 741533 has been marked as a duplicate of this bug. ***
and CVE-2011-1184: * http://svn.apache.org/viewvc?view=rev&rev=1159309 * http://svn.apache.org/viewvc?view=revision&revision=1158180 * http://svn.apache.org/viewvc?view=revision&revision=1087655
"""The Apache Tomcat security team will continue to treat this as a single issue using the reference CVE-2011-1184.""" Oh well, please forgot the latest comment :(
could you be so kind to prove some test cases or reproducer?
This is an autogenerated message for OBS integration: This bug (735343) was mentioned in https://build.opensuse.org/request/show/102913 11.4 / tomcat6 https://build.opensuse.org/request/show/102914 12.1 / tomcat6.openSUSE_12.1
Update released for: tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp, tomcat6-javadoc, tomcat6-jsp-2_1-api, tomcat6-lib, tomcat6-servlet-2_5-api, tomcat6-webapps Products: SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1-TERADATA (x86_64) SLES4VMWARE 11-SP1 (i386, x86_64) SUSE-MANAGER 1.2 (x86_64)
was released