Tomcat Authentication Response Error Lets Remote Users Determine Valid Usernames
|
|
SecurityTracker Alert ID: 1022332 |
|
SecurityTracker URL: http://securitytracker.com/id/1022332
|
|
CVE Reference:
CVE-2009-0580
(Links to External Site)
|
Date: Jun 4 2009
|
Impact:
Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 4.1.0 to 4.1.39, 5.5.0 to 5.5.27, 6.0.0 to 6.0.18
|
Description:
A vulnerability was reported in Apache Tomcat. A remote user can determine valid usernames on the target system.
In certain configurations, a remote user can send specially encoded password values to determine if the specified username exists on the target system.
Systems using form-based authentication (j_security_check) with one of the following
authentication realms are affected:
MemoryRealm
DataSourceRealm
JDBCRealm
D. Matscheko and T. Hackner of SEC Consult reported this vulnerability.
|
Impact:
A remote user can determine valid usernames on the target system.
|
Solution:
The vendor has issued a fix (6.0.20). The fix will be included in future versions 4.1.40 and 5.5.28.
|
Vendor URL: tomcat.apache.org/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 4 Jun 2009 00:03:03 -0400
Subject: Apache Tomcat
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2009-0580: Tomcat information disclosure vulnerability
Severity: Low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 4.1.0 to 4.1.39
Tomcat 5.5.0 to 5.5.27
Tomcat 6.0.0 to 6.0.18
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected.
Description:
Due to insufficient error checking in some authentication classes,
Tomcat allows for the enumeration (brute force testing) of usernames by
supplying illegally URL encoded passwords. The attack is possible if
form based authenticiaton (j_security_check) with one of the following
authentication realms is used:
* MemoryRealm
* DataSourceRealm
* JDBCRealm
Mitigation:
6.0.x users should do one of the following:
- upgrade to 6.0.20
- apply this patch http://svn.apache.org/viewvc?rev=747840&view=rev
5.5.x users should do one of the following:
- upgrade to 5.5.28 when released
- apply this patch http://svn.apache.org/viewvc?rev=781379&view=rev
4.1.x users should do one of the following:
- upgrade to 4.1.40 when released
- apply this patch http://svn.apache.org/viewvc?rev=781382&view=rev
Example:
The following POST request should trigger an error (500 server error or
empty response, depending on the configuration) if the ROOT web
application is configured to use FORM authentication:
POST /j_security_check HTTP/1.1
Host: localhost
j_username=tomcat&j_password=%
Credit:
This issue was discovered by D. Matscheko and T. Hackner of SEC Consult.
References:
http://tomcat.apache.org/security.html
Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkommckACgkQb7IeiTPGAkP75ACg7XYuld/25X2ltLLTeeQx88UB
pFgAn1f6mIpzU7QUnjF4lsHcR+6lY67B
=a0AC
-----END PGP SIGNATURE-----
|
|
