Bug 873664 (CVE-2012-5885, CVE-2012-5886, CVE-2012-5887)
| Summary: | CVE-2012-5885 CVE-2012-5886 CVE-2012-5887 tomcat: three DIGEST authentication implementation issues | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akurtako, aneelica, devrim, djorm, dknox, dwalluck, extras-orphan, ivan.afonichev, java-sig-commits, kdaniel, lfuka, pcheung, scorneli, sochotni |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Apache Tomcat 5.5.36, Apache Tomcat 6.0.36, Apache Tomcat 7.0.30 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-07-01 16:12:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 873672, 873703, 873707, 882008, 882009, 882010, 882011, 882012, 882013, 882014, 882015, 882019, 882020, 912962, 915386, 953308, 1014383 | ||
| Bug Blocks: | 873710, 906153, 953709 | ||
|
Description
Jan Lieskovsky
2012-11-06 13:07:56 UTC
These issues affect the version of the tomcat5 package, as shipped with Red Hat Enterprise Linux 5. -- These issues affect the version of the tomcat5 package, as shipped with JBoss Enterprise Web Server 1.0.2. -- These issues affect the version of the tomcat5 package, as shipped with Fedora release of 16. Created tomcat5 tracking bugs for this issue Affects: fedora-16 [bug 873672] Relevant upstream patch for Tomcat 6: [3] http://svn.apache.org/viewvc?view=revision&revision=1380829 Affected Tomcat 6 versions: From 6.0.0 up to 6.0.35. These issues affect the version of the tomcat6 package, as shipped with Red Hat Enterprise Linux 6. -- These issues affect the version of the tomcat6 package, as shipped with JBoss Enterprise Web Server 1.0.2. -- These issues affect the versions of the tomcat6 package, as shipped with Fedora release of 16 and 17. Relevant upstream patch for Tomcat 7: [4] http://svn.apache.org/viewvc?view=revision&revision=1377807 Affected Tomcat 7 versions: From 7.0.0 up to 7.0.29. These issues affect the version of the tomcat package, as shipped with Fedora release of 16. -- These issues does not affect the version of the tomcat package, as shipped with Fedora release of 17 (that version has been already updated). Created tomcat6 tracking bugs for this issue Affects: fedora-all [bug 873703] Created tomcat tracking bugs for this issue Affects: fedora-16 [bug 873707] The CVE identifier of CVE-2012-3439 has been rejected (and therefore should not be used) by MITRE: -- ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-5885, CVE-2012-5886, CVE-2012-5887. Reason: This candidate is a duplicate of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887. Notes: All CVE users should reference one or more of CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. -- in favour of the following three ids: CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887, whose description is as follows: 1) CVE-2012-5885: ================= The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5885 http://svn.apache.org/viewvc?view=revision&revision=1377807 http://svn.apache.org/viewvc?view=revision&revision=1380829 http://svn.apache.org/viewvc?view=revision&revision=1392248 http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2) CVE-2012-5886: ================= The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5886 http://svn.apache.org/viewvc?view=revision&revision=1377807 http://svn.apache.org/viewvc?view=revision&revision=1380829 http://svn.apache.org/viewvc?view=revision&revision=1392248 http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 3) CVE-2012-5887: ================= The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5887 http://svn.apache.org/viewvc?view=revision&revision=1377807 http://svn.apache.org/viewvc?view=revision&revision=1380829 http://svn.apache.org/viewvc?view=revision&revision=1392248 http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html tomcat-7.0.33-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in following products: JBoss Enterprise Web Server 2.0.0 Via RHSA-2013:0265 https://rhn.redhat.com/errata/RHSA-2013-0265.html This issue has been addressed in following products: JBEWS 2 for RHEL 5 JBEWS 2 for RHEL 6 Via RHSA-2013:0266 https://rhn.redhat.com/errata/RHSA-2013-0266.html This issue has been addressed in following products: JBEWP 5 for RHEL 4 JBEWP 5 for RHEL 5 JBEWP 5 for RHEL 6 Via RHSA-2013:0631 https://rhn.redhat.com/errata/RHSA-2013-0631.html This issue has been addressed in following products: JBEAP 5 for RHEL 4 JBEAP 5 for RHEL 5 JBEAP 5 for RHEL 6 Via RHSA-2013:0629 https://rhn.redhat.com/errata/RHSA-2013-0629.html This issue has been addressed in following products: JBoss Enterprise Web Platform 5.2.0 Via RHSA-2013:0633 https://rhn.redhat.com/errata/RHSA-2013-0633.html This issue has been addressed in following products: JBoss Enterprise Application Platform 5.2.0 Via RHSA-2013:0632 https://rhn.redhat.com/errata/RHSA-2013-0632.html This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:0623 https://rhn.redhat.com/errata/RHSA-2013-0623.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:0640 https://rhn.redhat.com/errata/RHSA-2013-0640.html This issue has been addressed in following products: JBoss Enterprise Application Platform 6.0.1 Via RHSA-2013:0648 https://rhn.redhat.com/errata/RHSA-2013-0648.html This issue has been addressed in following products: JBEAP 6 for RHEL 5 JBEAP 6 for RHEL 6 Via RHSA-2013:0647 https://rhn.redhat.com/errata/RHSA-2013-0647.html This issue has been addressed in following products: JBoss Data Grid 6.1.0 Via RHSA-2013:0665 https://rhn.redhat.com/errata/RHSA-2013-0665.html This issue has been addressed in following products: JBoss Enterprise SOA Platform 5.3.1 Via RHSA-2013:0726 https://rhn.redhat.com/errata/RHSA-2013-0726.html This issue has been addressed in following products: Red Hat JBoss BRMS 5.3.1 Via RHSA-2013:1006 https://rhn.redhat.com/errata/RHSA-2013-1006.html *** Bug 1275985 has been marked as a duplicate of this bug. *** |