Bug 503978 (CVE-2009-0580) - CVE-2009-0580 tomcat6 Information disclosure in authentication classes
Summary: CVE-2009-0580 tomcat6 Information disclosure in authentication classes
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-0580
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 503980 503981 504113 504115 528911 528913 528914 533903 533905 574565 574566
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-06-03 16:17 UTC by Marc Schoenefeld
Modified: 2019-09-29 12:30 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-10-25 20:10:48 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1143 0 normal SHIPPED_LIVE Important: JBoss Enterprise Application Platform 4.2.0.CP07 update 2009-07-06 11:42:19 UTC
Red Hat Product Errata RHSA-2009:1144 0 normal SHIPPED_LIVE Important: JBoss Enterprise Application Platform 4.2.0.CP07 update 2009-07-06 11:42:33 UTC
Red Hat Product Errata RHSA-2009:1145 0 normal SHIPPED_LIVE Important: JBoss Enterprise Application Platform 4.3.0.CP05 update 2009-07-06 11:41:01 UTC
Red Hat Product Errata RHSA-2009:1146 0 normal SHIPPED_LIVE Important: JBoss Enterprise Application Platform 4.3.0.CP05 update 2009-07-06 11:41:29 UTC
Red Hat Product Errata RHSA-2009:1164 0 normal SHIPPED_LIVE Important: tomcat security update 2009-07-21 20:56:29 UTC
Red Hat Product Errata RHSA-2009:1454 0 normal SHIPPED_LIVE Important: tomcat5 security update 2009-09-23 15:15:12 UTC
Red Hat Product Errata RHSA-2009:1506 0 normal SHIPPED_LIVE Important: tomcat6 security update 2009-10-14 16:15:15 UTC
Red Hat Product Errata RHSA-2009:1562 0 normal SHIPPED_LIVE Important: tomcat security update 2009-11-09 15:26:22 UTC
Red Hat Product Errata RHSA-2009:1563 0 normal SHIPPED_LIVE Important: tomcat security update 2009-11-09 15:37:31 UTC
Red Hat Product Errata RHSA-2009:1616 0 normal SHIPPED_LIVE Low: tomcat security update for Red Hat Network Satellite Server 2009-11-30 15:16:12 UTC
Red Hat Product Errata RHSA-2010:0602 0 normal SHIPPED_LIVE Moderate: Red Hat Certificate System 7.3 security update 2010-08-05 14:04:51 UTC

Description Marc Schoenefeld 2009-06-03 16:17:33 UTC 
Due to insufficient error checking in some authentication classes, Tomcat allows for the enumeration (brute force testing) of user names by supplying illegally URL encoded passwords. The attack is possible if FORM based authenticiaton (j_security_check) with either the MemoryRealm, DataSourceRealm or JDBCRealm.
Comment 2 Marc Schoenefeld 2009-06-03 16:50:16 UTC 
Patchset for tomcat5: http://svn.apache.org/viewvc?view=rev&revision=781379
Patchset for tomcat6: http://svn.apache.org/viewvc?view=rev&revision=747840
Comment 5 errata-xmlrpc 2009-07-06 11:41:05 UTC 
This issue has been addressed in following products:

  JBEAP 4.3.0 for RHEL 5

Via RHSA-2009:1145 https://rhn.redhat.com/errata/RHSA-2009-1145.html
Comment 6 errata-xmlrpc 2009-07-06 11:41:33 UTC 
This issue has been addressed in following products:

  JBEAP 4.3.0 for RHEL 4

Via RHSA-2009:1146 https://rhn.redhat.com/errata/RHSA-2009-1146.html
Comment 7 errata-xmlrpc 2009-07-06 11:42:22 UTC 
This issue has been addressed in following products:

  JBEAP 4.2.0 for RHEL 5

Via RHSA-2009:1143 https://rhn.redhat.com/errata/RHSA-2009-1143.html
Comment 8 errata-xmlrpc 2009-07-06 11:42:37 UTC 
This issue has been addressed in following products:

  JBEAP 4.2.0 for RHEL 4

Via RHSA-2009:1144 https://rhn.redhat.com/errata/RHSA-2009-1144.html
Comment 9 errata-xmlrpc 2009-07-21 20:56:38 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1164 https://rhn.redhat.com/errata/RHSA-2009-1164.html
Comment 11 errata-xmlrpc 2009-09-21 15:51:53 UTC 
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4
  JBEWS 1.0.0 for RHEL 5

Via RHSA-2009:1454 https://rhn.redhat.com/errata/RHSA-2009-1454.html
Comment 15 errata-xmlrpc 2009-10-14 16:15:21 UTC 
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 5
  JBEWS 1.0.0 for RHEL 4

Via RHSA-2009:1506 https://rhn.redhat.com/errata/RHSA-2009-1506.html
Comment 16 errata-xmlrpc 2009-11-09 15:26:29 UTC 
This issue has been addressed in following products:

  RHAPS Version 2 for RHEL 4

Via RHSA-2009:1562 https://rhn.redhat.com/errata/RHSA-2009-1562.html
Comment 17 errata-xmlrpc 2009-11-09 15:37:37 UTC 
This issue has been addressed in following products:

  Red Hat Developer Suite V.3

Via RHSA-2009:1563 https://rhn.redhat.com/errata/RHSA-2009-1563.html
Comment 21 errata-xmlrpc 2009-11-30 15:16:18 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.2
  Red Hat Network Satellite Server v 5.3

Via RHSA-2009:1616 https://rhn.redhat.com/errata/RHSA-2009-1616.html
Comment 24 errata-xmlrpc 2010-08-04 21:31:11 UTC 
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html
Comment 25 Kurt Seifried 2011-10-25 20:10:48 UTC 
All children bugs are closed, closing parent bug
Note You need to log in before you can comment on or make changes to this bug.