4.3
CVSSv2

CVE-2009-0580

Published: 05/06/2009 Updated: 25/03/2019
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 475
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Summary

Apache Tomcat 4.1.0 up to and including 4.1.39, 5.5.0 up to and including 5.5.27, and 6.0.0 up to and including 6.0.18, when FORM authentication is used, allows remote malicious users to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.
Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat 4.1.0

apache tomcat 4.1.1

apache tomcat 4.1.2

apache tomcat 4.1.3

apache tomcat 4.1.4

apache tomcat 4.1.5

apache tomcat 4.1.6

apache tomcat 4.1.7

apache tomcat 4.1.8

apache tomcat 4.1.9

apache tomcat 4.1.10

apache tomcat 4.1.11

apache tomcat 4.1.12

apache tomcat 4.1.13

apache tomcat 4.1.14

apache tomcat 4.1.15

apache tomcat 4.1.16

apache tomcat 4.1.17

apache tomcat 4.1.18

apache tomcat 4.1.19

apache tomcat 4.1.20

apache tomcat 4.1.21

apache tomcat 4.1.22

apache tomcat 4.1.23

apache tomcat 4.1.24

apache tomcat 4.1.25

apache tomcat 4.1.26

apache tomcat 4.1.27

apache tomcat 4.1.28

apache tomcat 4.1.29

apache tomcat 4.1.30

apache tomcat 4.1.31

apache tomcat 4.1.32

apache tomcat 4.1.33

apache tomcat 4.1.34

apache tomcat 4.1.35

apache tomcat 4.1.36

apache tomcat 4.1.37

apache tomcat 4.1.38

apache tomcat 4.1.39

apache tomcat 5.5.0

apache tomcat 5.5.1

apache tomcat 5.5.2

apache tomcat 5.5.3

apache tomcat 5.5.4

apache tomcat 5.5.5

apache tomcat 5.5.6

apache tomcat 5.5.7

apache tomcat 5.5.8

apache tomcat 5.5.9

apache tomcat 5.5.10

apache tomcat 5.5.11

apache tomcat 5.5.12

apache tomcat 5.5.13

apache tomcat 5.5.14

apache tomcat 5.5.15

apache tomcat 5.5.16

apache tomcat 5.5.17

apache tomcat 5.5.18

apache tomcat 5.5.19

apache tomcat 5.5.20

apache tomcat 5.5.21

apache tomcat 5.5.22

apache tomcat 5.5.23

apache tomcat 5.5.24

apache tomcat 5.5.25

apache tomcat 5.5.26

apache tomcat 5.5.27

apache tomcat 6.0.0

apache tomcat 6.0.1

apache tomcat 6.0.2

apache tomcat 6.0.3

apache tomcat 6.0.4

apache tomcat 6.0.5

apache tomcat 6.0.6

apache tomcat 6.0.7

apache tomcat 6.0.8

apache tomcat 6.0.9

apache tomcat 6.0.10

apache tomcat 6.0.11

apache tomcat 6.0.12

apache tomcat 6.0.13

apache tomcat 6.0.14

apache tomcat 6.0.15

apache tomcat 6.0.16

Vendor Advisories

Synopsis Important: JBoss Enterprise Application Platform 430CP05 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform (JBEAP) 43 packages that fixvarious issues are now available for Red Hat Enterprise Linux 5 as JBEAP430CP05This update has been rate ...
Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix several security issues are now availablefor Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team D ...
Iida Minehiko discovered that Tomcat did not properly normalise paths A remote attacker could send specially crafted requests to the server and bypass security restrictions, gaining access to sensitive content (CVE-2008-5515) ...
Debian Bug report logs - #532362 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 6 Multiple Vulnerabilities Package: tomcat6; Maintainer for tomcat6 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun ...
Debian Bug report logs - #532363 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 5 Multiple Vulnerabilities Package: tomcat5; Maintainer for tomcat5 is (unknown); Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun 2009 20:39:02 UTC Severity: serious Tags: patch, security Found i ...

Exploits

source: wwwsecurityfocuscom/bid/35196/info Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists Attackers may exploit this weakness to discern valid usernames This may aid them in brute-force password cracking or other attack ...

Metasploit Modules

Apache Tomcat User Enumeration

This module enumerates Apache Tomcat's usernames via malformed requests to j_security_check, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default. The 'admin' package is no longer provided for Tomcat 6 and later versions.

msf > use auxiliary/scanner/http/tomcat_enum
      msf auxiliary(tomcat_enum) > show actions
            ...actions...
      msf auxiliary(tomcat_enum) > set ACTION <action-name>
      msf auxiliary(tomcat_enum) > show options
            ...show and set options...
      msf auxiliary(tomcat_enum) > run

References

CWE-200http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlhttp://marc.info/?l=bugtraq&m=127420533226623&w=2http://marc.info/?l=bugtraq&m=129070310906557&w=2http://marc.info/?l=bugtraq&m=133469267822771&w=2http://marc.info/?l=bugtraq&m=136485229118404&w=2http://secunia.com/advisories/35326http://secunia.com/advisories/35344http://secunia.com/advisories/35685http://secunia.com/advisories/35788http://secunia.com/advisories/37460http://secunia.com/advisories/42368http://securitytracker.com/id?1022332http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1http://support.apple.com/kb/HT4077http://svn.apache.org/viewvc?rev=747840&view=revhttp://svn.apache.org/viewvc?rev=781379&view=revhttp://svn.apache.org/viewvc?rev=781382&view=revhttp://tomcat.apache.org/security-4.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://www.debian.org/security/2011/dsa-2207http://www.mandriva.com/security/advisories?name=MDVSA-2009:136http://www.mandriva.com/security/advisories?name=MDVSA-2009:138http://www.mandriva.com/security/advisories?name=MDVSA-2010:176http://www.securityfocus.com/archive/1/504045/100/0/threadedhttp://www.securityfocus.com/archive/1/504108/100/0/threadedhttp://www.securityfocus.com/archive/1/504125/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/bid/35196http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/1496http://www.vupen.com/english/advisories/2009/1856http://www.vupen.com/english/advisories/2009/3316http://www.vupen.com/english/advisories/2010/3056https://exchange.xforce.ibmcloud.com/vulnerabilities/50930https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6628https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.htmlhttps://www.rapid7.com/db/vulnerabilities/vmsa-2009-0016-5-update-apache-tomcat-version-cve-2009-0580https://access.redhat.com/errata/RHSA-2009:1145http://tools.cisco.com/security/center/viewAlert.x?alertId=18331https://nvd.nist.govhttps://www.exploit-db.com/exploits/33023/https://www.rapid7.com/db/modules/auxiliary/scanner/http/tomcat_enumhttps://usn.ubuntu.com/788-1/