Bug 741401 (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064)

Summary: CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 tomcat: Multiple weaknesses in HTTP DIGEST authentication
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amaris, awnuk, cfu, csutherl, devrim, djorm, dknox, dwalluck, extras-orphan, jclere, jdennis, jpazdziora, pcheung, sochotni, SpikeFedora, tromey, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
See Also: https://bugzilla.redhat.com/show_bug.cgi?id=794382
https://bugzilla.redhat.com/show_bug.cgi?id=758931
Whiteboard: impact=moderate,public=20110926,reported=20110926,source=upstream,cvss2=4.3/AV:N/AC:M/Au:N/C:P/I:N/A:N,rhel-5/tomcat5=affected,rhel-6/tomcat6=affected,jbews-1/tomcat5=affected,jbews-1/tomcat6=affected,fedora-all/tomcat5=affected,fedora-all/tomcat6=affected,RHDS3/Platform=wontfix,certificate_system_7.3/Authentication=wontfix,rhn_satellite_5.4/Server=wontfix
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-15 02:27:25 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 738503, 738504, 738505, 738506, 738507, 741406, 741407, 744983, 744984, 802291    
Bug Blocks: 741415, 795277, 810065    

Description Jan Lieskovsky 2011-09-26 14:08:38 EDT
Multiple security flaws were found in the Apache Tomcat HTTP DIGEST (RFC 2069) Authentication implementation:
* it was possible to perform session reply attacks,
* server generated nonce-values were not checked,
* count of client generated nonce-values were not checked,
* quality of protection (qop) values were not checked,
* realms values were not checked,
* a known, hard-coded string was used as server secret.

References:
[1] http://tomcat.apache.org/security-5.html
[2] http://tomcat.apache.org/security-6.html
[3] http://www.securityfocus.com/archive/1/519818/30/0/threaded

Relevant upstream patches:
[4] http://svn.apache.org/viewvc?view=revision&revision=1158180
    (for Tomcat 6 version),
[5] http://svn.apache.org/viewvc?view=revision&revision=1159309
    (for Tomcat 5 version).
Comment 1 Jan Lieskovsky 2011-09-26 14:11:59 EDT
This issue affects the version of the tomcat5 package, as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the tomcat5 package, as shipped with Fedora release of 14 and 15.

--

This issue affects the version of the tomcat6 package, as shipped with Red Hat Enterprise Linux 6.

This issue affects the versions of the tomcat6 package, as shipped with Fedora release of 14 and 15.
Comment 2 Jan Lieskovsky 2011-09-26 14:14:16 EDT
Created tomcat6 tracking bugs for this issue

Affects: fedora-all [bug 741407]
Comment 3 Jan Lieskovsky 2011-09-26 14:14:26 EDT
Created tomcat5 tracking bugs for this issue

Affects: fedora-all [bug 741406]
Comment 7 errata-xmlrpc 2011-12-05 12:49:13 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1780 https://rhn.redhat.com/errata/RHSA-2011-1780.html
Comment 8 errata-xmlrpc 2011-12-20 12:26:10 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1845 https://rhn.redhat.com/errata/RHSA-2011-1845.html
Comment 9 Kurt Seifried 2012-01-14 21:54:15 EST
CVE has split these issues up:

======================================================
Name: CVE-2011-1184
related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.

======================================================
Name: CVE-2011-5062
bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

======================================================
Name: CVE-2011-5063
does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.

======================================================
Name: CVE-2011-5064

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
Comment 10 David Jorm 2012-01-16 06:52:58 EST
*** Bug 781909 has been marked as a duplicate of this bug. ***
Comment 11 David Jorm 2012-01-16 06:53:43 EST
*** Bug 781911 has been marked as a duplicate of this bug. ***
Comment 12 David Jorm 2012-01-16 06:54:07 EST
*** Bug 781912 has been marked as a duplicate of this bug. ***
Comment 13 errata-xmlrpc 2012-01-19 12:22:23 EST
This issue has been addressed in following products:

   JBoss Enterprise Application Platform 4.3.0 CP10

Via RHSA-2012:0041 https://rhn.redhat.com/errata/RHSA-2012-0041.html
Comment 14 errata-xmlrpc 2012-01-31 18:04:15 EST
This issue has been addressed in following products:

  JBoss Communications Platform 5.1.3

Via RHSA-2012:0078 https://rhn.redhat.com/errata/RHSA-2012-0078.html
Comment 15 errata-xmlrpc 2012-01-31 18:06:36 EST
This issue has been addressed in following products:

   JBoss Enterprise Web Platform 5.1.2

Via RHSA-2012:0077 https://rhn.redhat.com/errata/RHSA-2012-0077.html
Comment 16 errata-xmlrpc 2012-01-31 18:06:59 EST
This issue has been addressed in following products:

  JBEWP 5 for RHEL 6
  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5

Via RHSA-2012:0076 https://rhn.redhat.com/errata/RHSA-2012-0076.html
Comment 17 errata-xmlrpc 2012-01-31 18:07:20 EST
This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.1.2

Via RHSA-2012:0075 https://rhn.redhat.com/errata/RHSA-2012-0075.html
Comment 18 errata-xmlrpc 2012-01-31 18:07:42 EST
This issue has been addressed in following products:

  JBEAP 5 for RHEL 6
  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5

Via RHSA-2012:0074 https://rhn.redhat.com/errata/RHSA-2012-0074.html
Comment 19 errata-xmlrpc 2012-02-02 17:20:09 EST
This issue has been addressed in following products:

  JBoss Enterprise Portal Platform 4.3 CP07

Via RHSA-2012:0091 https://rhn.redhat.com/errata/RHSA-2012-0091.html
Comment 20 errata-xmlrpc 2012-02-22 00:11:13 EST
This issue has been addressed in following products:

JBoss Enterprise BRMS Platform 5.2.0, JBoss Enterprise Portal Platform 5.2.0 and JBoss Enterprise SOA Platform 5.2.0

Via RHSA-2012:0325 https://rhn.redhat.com/errata/RHSA-2012-0325.html
Comment 21 Coty Sutherland 2012-05-01 12:45:12 EDT
Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?
Comment 22 David Jorm 2012-05-01 20:00:48 EDT
(In reply to comment #21)
> Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?

An erratum for EWS 1.0.2 is in progress. It is currently awaiting QE.
Comment 23 errata-xmlrpc 2012-05-21 12:33:08 EDT
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0680 https://rhn.redhat.com/errata/RHSA-2012-0680.html
Comment 24 errata-xmlrpc 2012-05-21 12:34:19 EDT
This issue has been addressed in following products:

  JBEWS 1.0

Via RHSA-2012:0679 https://rhn.redhat.com/errata/RHSA-2012-0679.html
Comment 25 errata-xmlrpc 2012-05-21 12:41:23 EDT
This issue has been addressed in following products:

  JBEWS 1.0

Via RHSA-2012:0681 https://rhn.redhat.com/errata/RHSA-2012-0681.html
Comment 26 errata-xmlrpc 2012-05-21 12:52:42 EDT
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0682 https://rhn.redhat.com/errata/RHSA-2012-0682.html