Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure

• Exploit Database
• 15 阅读

• 作者： Deniz Cevik
  日期： 2010-04-22
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/12343/

• CVE-2010-1157: Apache Tomcat information disclosure vulnerability
  
  Severity: Low
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  
  - - Tomcat 6.0.0 to 6.0.26
  
  - - Tomcat 5.5.0 to 5.5.29
  
  Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be
  affected.
  
  
  Description:
  
  The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a
  realm name. If a <realm-name> element is specified for the application in
  web.xml it will be used. However, a <realm-name> is not specified then
  Tomcat will generate one using the code snippet:
  
  request.getServerName() + ":" + request.getServerPort() In some
  circumstances this can expose the local hostname or IP address of the
  machine running Tomcat.
  
  Example:
  
  GET /application/j_security_check HTTP/1.0
  
  
  HTTP/1.1 401 Unauthorized
  
  Server: Apache-Coyote/1.1
  
  WWW-Authenticate: Basic realm="tomcat01:8080"
  
  Content-Type: text/html;charset=utf-8
  
  Content-Length: 954
  
  Date: Thu, 31 Dec 2009 12:18:11 GMT
  
  Connection: close
  
  
  Mitigation:
  
  Administrators of web applications that use BASIC or DIGEST authentication
  are recommended to set an appropriate realm name in the web application's
  web.xml file.
  
  Alternatively, the following patches may be used to change the default realm
  to "Authentication required" (without the quotes):
  
  - - Tomcat 6.0.x: http://svn.apache.org/viewvc?view=rev&rev=936540
  
  - - Tomcat 5.5.x: http://svn.apache.org/viewvc?view=rev&rev=936541
  
  These patches will be included in the next releases of Tomcat 5.5.x and
  Tomcat 6.0.x. No release date has been set for the next Tomcat 5.5.x and
  Tomcat 6.0.x releases.
  
  
  Credit:
  
  This issue was discovered by Deniz Cevik.
  
  
  References:
  
  http://tomcat.apache.org/security.html
  
  http://tomcat.apache.org/security-6.html
  
  http://tomcat.apache.org/security-5.html