SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Apache Tomcat May Ignore @ServletSecurity Annotation Protections
SecurityTracker Alert ID:  1025215
SecurityTracker URL:  http://securitytracker.com/id/1025215
CVE Reference:   CVE-2011-1088, CVE-2011-1183, CVE-2011-1582   (Links to External Site)
Updated:  May 20 2011
Original Entry Date:  Mar 15 2011
Impact:   Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.0.0 to 7.0.13
Description:   A vulnerability was reported in Apache Tomcat. A remote user may be able to bypass certain security protections.

The system ignores @ServletSecurity annotations when starting a web application. As a result, some areas of the application not receive the expected protection.

Impact:   A remote user may be able to bypass @ServletSecurity annotation protections.
Solution:   The vendor has issued a fix (7.0.14).

The vendor's original fixes (7.0.11 and 7.0.12) contained flaws [CVE-2011-1183 and CVE-2011-1582].

The vendor's original advisories are available at:

http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.11_(released_11_Mar_2011)
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.12_(released_6_Apr_2011)

The vendor's advisory is available at:

http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_(released_12_May_2011)

Vendor URL:  tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_(released_12_May_2011) (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Tue, 15 Mar 2011 08:45:26 +0000
Subject:  [SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2011-1088 Apache Tomcat security constraint bypass

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
- - Tomcat 7.0.0 to 7.0.10
- - Earlier versions are not affected

Description:
When a web application was started, @ServletSecurity annotations were
ignored. This meant that some areas of the application may not have been
protected as expected.

Mitigation:
Users of affected versions should apply one of the following mitigations:
- - Upgrade to a Tomcat version where this issue is fixed
- - Define security constraints via an alternative mechanism such as web.xml

Credit:
This issue was reported publicly on the Tomcat users mailing list.
The Apache Tomcat security requests that security vulnerability reports
are made privately to security@tomcat.apache.org in the first instance.

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJNfycmAAoJEBDAHFovYFnn3jgP/0aecIt4uUYHWbmzUPA0FNan
tzjVfPskwPYrSuNbHjHuxPknmxUPSFiCdO3V1LLtnCX2y5+cNancWRjLX7lDbt8H
sL+9AaoI8HDShG1wgYsnh/3fIKczhE28pTtyo0GtG4HpQVLcT/OH2Qhb6+mG3jwo
SCia1eSTJuhj5HM3n2fb5X33n/UEkX/cCALDrt1DRfKV69MaZbMiZh7XfpyVDpdN
LePYIeuOoxg9CVjkDYCVIaK5Bi0uzPD8yCc73dOU3YobgbDDaLSN7Awd1/RhO5TR
fpWVbl0gbmMlPnMy52B9qZL+H9HwcNnYPqbtpquE2a6ik29QT4LMTNo0mr25XxmP
K3Jb7VTcVb/P1pxFOsTyMWy25IFubMEBW4c3kafBZGUI3Q25QmNizBXZ5wvn1vex
kBzDZrnKmkzvhnCy6RnTKk9BYGRWEw9ImTqLOaLxmtXJw9bnWgoeusnje1k/24QI
3+pw/g5OjwG7hqtStrscFeo8tc/snXBojn1d21txsnLggQ0E6+9+vUVym5tBD16I
MfzN7FSd620AFSmVUo5mEfEpDe+RTkA8y/7BnYHoguBQ7WLlxejCgRpaf91vBns6
ZEQGntzx7EW7M+P2GNHy1mrVGTQ7Glk/5tnAFyqgMOHzYyN11Y3OWO1XBv+1um8q
kadENSXz4mY0vKtvaeuT
=i/HJ
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC