Bug 741401 - (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064) CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 tomcat: Multiple weaknesses in HTTP DIGEST authentication
CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 tomcat: Multiple weak...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20110926,repor...
: Security
: 781909 781911 781912 (view as bug list)
Depends On: 738503 738504 738505 738506 738507 741406 741407 744983 744984 802291
Blocks: 741415 795277 810065
  Show dependency treegraph
 
Reported: 2011-09-26 14:08 EDT by Jan Lieskovsky
Modified: 2016-11-08 11:07 EST (History)
16 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-15 02:27:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2011-09-26 14:08:38 EDT
Multiple security flaws were found in the Apache Tomcat HTTP DIGEST (RFC 2069) Authentication implementation:
* it was possible to perform session reply attacks,
* server generated nonce-values were not checked,
* count of client generated nonce-values were not checked,
* quality of protection (qop) values were not checked,
* realms values were not checked,
* a known, hard-coded string was used as server secret.

References:
[1] http://tomcat.apache.org/security-5.html
[2] http://tomcat.apache.org/security-6.html
[3] http://www.securityfocus.com/archive/1/519818/30/0/threaded

Relevant upstream patches:
[4] http://svn.apache.org/viewvc?view=revision&revision=1158180
    (for Tomcat 6 version),
[5] http://svn.apache.org/viewvc?view=revision&revision=1159309
    (for Tomcat 5 version).
Comment 1 Jan Lieskovsky 2011-09-26 14:11:59 EDT
This issue affects the version of the tomcat5 package, as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the tomcat5 package, as shipped with Fedora release of 14 and 15.

--

This issue affects the version of the tomcat6 package, as shipped with Red Hat Enterprise Linux 6.

This issue affects the versions of the tomcat6 package, as shipped with Fedora release of 14 and 15.
Comment 2 Jan Lieskovsky 2011-09-26 14:14:16 EDT
Created tomcat6 tracking bugs for this issue

Affects: fedora-all [bug 741407]
Comment 3 Jan Lieskovsky 2011-09-26 14:14:26 EDT
Created tomcat5 tracking bugs for this issue

Affects: fedora-all [bug 741406]
Comment 7 errata-xmlrpc 2011-12-05 12:49:13 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1780 https://rhn.redhat.com/errata/RHSA-2011-1780.html
Comment 8 errata-xmlrpc 2011-12-20 12:26:10 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1845 https://rhn.redhat.com/errata/RHSA-2011-1845.html
Comment 9 Kurt Seifried 2012-01-14 21:54:15 EST
CVE has split these issues up:

======================================================
Name: CVE-2011-1184
related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.

======================================================
Name: CVE-2011-5062
bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

======================================================
Name: CVE-2011-5063
does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.

======================================================
Name: CVE-2011-5064

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
Comment 10 David Jorm 2012-01-16 06:52:58 EST
*** Bug 781909 has been marked as a duplicate of this bug. ***
Comment 11 David Jorm 2012-01-16 06:53:43 EST
*** Bug 781911 has been marked as a duplicate of this bug. ***
Comment 12 David Jorm 2012-01-16 06:54:07 EST
*** Bug 781912 has been marked as a duplicate of this bug. ***
Comment 13 errata-xmlrpc 2012-01-19 12:22:23 EST
This issue has been addressed in following products:

   JBoss Enterprise Application Platform 4.3.0 CP10

Via RHSA-2012:0041 https://rhn.redhat.com/errata/RHSA-2012-0041.html
Comment 14 errata-xmlrpc 2012-01-31 18:04:15 EST
This issue has been addressed in following products:

  JBoss Communications Platform 5.1.3

Via RHSA-2012:0078 https://rhn.redhat.com/errata/RHSA-2012-0078.html
Comment 15 errata-xmlrpc 2012-01-31 18:06:36 EST
This issue has been addressed in following products:

   JBoss Enterprise Web Platform 5.1.2

Via RHSA-2012:0077 https://rhn.redhat.com/errata/RHSA-2012-0077.html
Comment 16 errata-xmlrpc 2012-01-31 18:06:59 EST
This issue has been addressed in following products:

  JBEWP 5 for RHEL 6
  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5

Via RHSA-2012:0076 https://rhn.redhat.com/errata/RHSA-2012-0076.html
Comment 17 errata-xmlrpc 2012-01-31 18:07:20 EST
This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.1.2

Via RHSA-2012:0075 https://rhn.redhat.com/errata/RHSA-2012-0075.html
Comment 18 errata-xmlrpc 2012-01-31 18:07:42 EST
This issue has been addressed in following products:

  JBEAP 5 for RHEL 6
  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5

Via RHSA-2012:0074 https://rhn.redhat.com/errata/RHSA-2012-0074.html
Comment 19 errata-xmlrpc 2012-02-02 17:20:09 EST
This issue has been addressed in following products:

  JBoss Enterprise Portal Platform 4.3 CP07

Via RHSA-2012:0091 https://rhn.redhat.com/errata/RHSA-2012-0091.html
Comment 20 errata-xmlrpc 2012-02-22 00:11:13 EST
This issue has been addressed in following products:

JBoss Enterprise BRMS Platform 5.2.0, JBoss Enterprise Portal Platform 5.2.0 and JBoss Enterprise SOA Platform 5.2.0

Via RHSA-2012:0325 https://rhn.redhat.com/errata/RHSA-2012-0325.html
Comment 21 Coty Sutherland 2012-05-01 12:45:12 EDT
Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?
Comment 22 David Jorm 2012-05-01 20:00:48 EDT
(In reply to comment #21)
> Are we making any kind of progress on this for EWS 1.0.2 (tomcat 6.0.32)?

An erratum for EWS 1.0.2 is in progress. It is currently awaiting QE.
Comment 23 errata-xmlrpc 2012-05-21 12:33:08 EDT
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0680 https://rhn.redhat.com/errata/RHSA-2012-0680.html
Comment 24 errata-xmlrpc 2012-05-21 12:34:19 EDT
This issue has been addressed in following products:

  JBEWS 1.0

Via RHSA-2012:0679 https://rhn.redhat.com/errata/RHSA-2012-0679.html
Comment 25 errata-xmlrpc 2012-05-21 12:41:23 EDT
This issue has been addressed in following products:

  JBEWS 1.0

Via RHSA-2012:0681 https://rhn.redhat.com/errata/RHSA-2012-0681.html
Comment 26 errata-xmlrpc 2012-05-21 12:52:42 EDT
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0682 https://rhn.redhat.com/errata/RHSA-2012-0682.html

Note You need to log in before you can comment on or make changes to this bug.