SuSE 11.1 Security Update : tomcat6 (SAT Patch Number 5759)

medium Nessus Plugin ID 57855

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

This update fixes a regression in parameter passing (in urldecoding of parameters that contain spaces).

In addition, multiple weaknesses in HTTP DIGESTS have been fixed (CVE-2011-1184) :

- The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33 and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
(CVE-2011-5062)

- The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. (CVE-2011-5063)

- DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. (CVE-2011-5064)

Solution

Apply SAT patch number 5759.

Plugin Details

Severity: Medium

ID: 57855

File Name: suse_11_tomcat6-120206.nasl

Version: 1.7

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 2/7/2012

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:tomcat6, p-cpe:/a:novell:suse_linux:11:tomcat6-admin-webapps, p-cpe:/a:novell:suse_linux:11:tomcat6-docs-webapp, p-cpe:/a:novell:suse_linux:11:tomcat6-javadoc, p-cpe:/a:novell:suse_linux:11:tomcat6-jsp-2_1-api, p-cpe:/a:novell:suse_linux:11:tomcat6-lib, p-cpe:/a:novell:suse_linux:11:tomcat6-servlet-2_5-api, p-cpe:/a:novell:suse_linux:11:tomcat6-webapps, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2/6/2012

Reference Information

CVE: CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064

Detections

Analytics