bugtraq - [SECURITY] CVE-2011-2204 - Apache Tomcat information disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4E086B98.8050505__26984.55283321$1309174741$gmane$org@apache.org>
Date: Mon, 27 Jun 2011 12:38:00 +0100
From: Mark Thomas <markt@...che.org>
To: Tomcat Users List <users@...cat.apache.org>
Cc: Tomcat Announce List <announce@...cat.apache.org>, 
 announce@...che.org, Tomcat Developers List <dev@...cat.apache.org>, 
 full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [SECURITY] CVE-2011-2204 - Apache Tomcat information disclosure

CVE-2011-2204 Apache Tomcat information disclosure

Severity: Low
Vendor: The Apache Software Foundation

Versions Affected:
- Tomcat 7.0.0 to 7.0.16
- Tomcat 6.0.0 to 6.0.32
- Tomcat 5.5.0 to 5.5.33
Earlier, unsupported versions may also be affected

Description:
When using the MemoryUserDatabase (based on tomcat-users.xml) and
creating users via JMX, an exception during the user creation process
may trigger an error message in the JMX client that includes the user's
password. This error message is also written to the Tomcat logs. User
passwords are visible to administrators with JMX access and/or
administrators with read access to the tomcat-users.xml file. Users that
do not have these permissions but are able to read log files may be able
to discover a user's password.

Steps to reproduce:
The Tomcat security team has been unable to reproduce this error without
forcing an exception by modifying the Tomcat source code. In theory, an
OutOfMemoryError at exactly the right point could trigger this
vulnerability.

Mitigation:
Users of affected versions should apply one of the following mitigations:
- Don't manage the MemoryUserDatabase via JMX
- Use digested passwords
- Limit access to Tomcat log files
- Upgrade to a Tomcat 7.0.17, 6.0.33 or 5.5.34 or later once released
- Apply the appropriate patch
  - 7.0.x: http://svn.apache.org/viewvc?rev=1140070&view=rev
  - 6.0.x: http://svn.apache.org/viewvc?rev=1140071&view=rev
  - 5.5.x: http://svn.apache.org/viewvc?rev=1140072&view=rev

Credit:
This issue was identified by Polina Genova and reported privately to the
Tomcat Security Team via security@...cat.apache.org.

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html