The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

Versions of Tomcat 7.0.x earlier than 7.0.12 are potentially affected by multiple vulnerabilities : 

  - An information disclosure exists in the HTTP BIO connector. (CVE-2011-1475)

  - A security bypass vulnerability exists due to a regression in the fix for CVE-2011-1088.  Note that this issue only affects Tomcat 7.0.11.(CVE-2011-1183)

The version of Tomcat installed on the remote host is prior to 7.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.12_security-7 advisory.

  - The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining,     which allows remote attackers to read responses intended for other clients in opportunistic circumstances     by examining the application data in HTTP packets, related to a mix-up of responses for requests from     different users. (CVE-2011-1475)

  - The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before     6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass     intended access restrictions by leveraging the availability of a protection space with weaker     authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
    (CVE-2011-5063)

  - Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers     to bypass intended access restrictions via HTTP requests to a web application. (CVE-2011-1088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
800625	Apache Tomcat 7.0.x < 7.0.12 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium
53323	Apache Tomcat 7.0.0 < 7.0.12 multiple vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2011-1475

medium

Tenable Plugins

medium

medium

medium