Published: 05/06/2009 Updated: 13/02/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 475

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Apache Tomcat 4.1.0 up to and including 4.1.39, 5.5.0 up to and including 5.5.27, and 6.0.0 up to and including 6.0.18, when FORM authentication is used, allows remote malicious users to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 5.5.27
apache tomcat 4.1.2
apache tomcat 4.1.35
apache tomcat 4.1.36
apache tomcat 4.1.9
apache tomcat 5.5.18
apache tomcat 4.1.21
apache tomcat 6.0.6
apache tomcat 6.0.11
apache tomcat 5.5.12
apache tomcat 5.5.14
apache tomcat 4.1.24
apache tomcat 5.5.10
apache tomcat 5.5.4
apache tomcat 5.5.7
apache tomcat 5.5.1
apache tomcat 6.0.7
apache tomcat 5.5.11
apache tomcat 4.1.25
apache tomcat 6.0.4
apache tomcat 5.5.6
apache tomcat 5.5.26
apache tomcat 4.1.39
apache tomcat 4.1.4
apache tomcat 5.5.20
apache tomcat 5.5.15
apache tomcat 5.5.5
apache tomcat 4.1.27
apache tomcat 6.0.15
apache tomcat 4.1.30
apache tomcat 4.1.7
apache tomcat 4.1.38
apache tomcat 4.1.11
apache tomcat 5.5.21
apache tomcat 4.1.18
apache tomcat 5.5.22
apache tomcat 4.1.14
apache tomcat 6.0.10
apache tomcat 6.0.3
apache tomcat 4.1.19
apache tomcat 6.0.9
apache tomcat 4.1.31
apache tomcat 5.5.3
apache tomcat 4.1.16
apache tomcat 4.1.29
apache tomcat 4.1.22
apache tomcat 4.1.5
apache tomcat 4.1.26
apache tomcat 4.1.13
apache tomcat 4.1.8
apache tomcat 5.5.9
apache tomcat 5.5.25
apache tomcat 6.0.0
apache tomcat 4.1.17
apache tomcat 6.0.14
apache tomcat 5.5.2
apache tomcat 4.1.33
apache tomcat 5.5.0
apache tomcat 4.1.1
apache tomcat 5.5.13
apache tomcat 6.0.1
apache tomcat 6.0.12
apache tomcat 5.5.24
apache tomcat 4.1.12
apache tomcat 4.1.28
apache tomcat 4.1.15
apache tomcat 4.1.3
apache tomcat 4.1.10
apache tomcat 5.5.8
apache tomcat 5.5.16
apache tomcat 4.1.0
apache tomcat 6.0.5
apache tomcat 4.1.20
apache tomcat 5.5.17
apache tomcat 5.5.19
apache tomcat 4.1.23
apache tomcat 4.1.34
apache tomcat 4.1.32
apache tomcat 4.1.37
apache tomcat 6.0.2
apache tomcat 6.0.13
apache tomcat 5.5.23
apache tomcat 4.1.6
apache tomcat 6.0.16
apache tomcat 6.0.8

Synopsis Important: JBoss Enterprise Application Platform 430CP05 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform (JBEAP) 43 packages that fixvarious issues are now available for Red Hat Enterprise Linux 5 as JBEAP430CP05This update has been rate ...

Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix several security issues are now availablefor Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team D ...

Iida Minehiko discovered that Tomcat did not properly normalise paths A remote attacker could send specially crafted requests to the server and bypass security restrictions, gaining access to sensitive content (CVE-2008-5515) ...

Debian Bug report logs - #532362 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 6 Multiple Vulnerabilities Package: tomcat6; Maintainer for tomcat6 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun ...

Debian Bug report logs - #532363 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 5 Multiple Vulnerabilities Package: tomcat5; Maintainer for tomcat5 is (unknown); Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun 2009 20:39:02 UTC Severity: serious Tags: patch, security Found i ...

source: wwwsecurityfocuscom/bid/35196/info Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists Attackers may exploit this weakness to discern valid usernames This may aid them in brute-force password cracking or other attack ...

This module enumerates Apache Tomcat's usernames via malformed requests to j_security_check, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default. The 'admin' package is no longer provided for Tomcat 6 and later versions.

msf > use auxiliary/scanner/http/tomcat_enum
      msf auxiliary(tomcat_enum) > show actions
            ...actions...
      msf auxiliary(tomcat_enum) > set ACTION <action-name>
      msf auxiliary(tomcat_enum) > show options
            ...show and set options...
      msf auxiliary(tomcat_enum) > run

CWE-200 http://svn.apache.org/viewvc?rev=747840&view=rev http://svn.apache.org/viewvc?rev=781379&view=rev http://www.securityfocus.com/bid/35196 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-5.html http://secunia.com/advisories/35326 http://secunia.com/advisories/35344 http://securitytracker.com/id?1022332 http://tomcat.apache.org/security-4.html http://www.vupen.com/english/advisories/2009/1496 http://svn.apache.org/viewvc?rev=781382&view=rev http://www.mandriva.com/security/advisories?name=MDVSA-2009:138 http://www.mandriva.com/security/advisories?name=MDVSA-2009:136 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://www.vupen.com/english/advisories/2009/1856 http://secunia.com/advisories/35685 http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 http://secunia.com/advisories/35788 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html http://www.vupen.com/english/advisories/2009/3316 http://secunia.com/advisories/37460 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html http://www.vmware.com/security/advisories/VMSA-2009-0016.html https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html http://support.apple.com/kb/HT4077 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:176 http://marc.info/?l=bugtraq&m=129070310906557&w=2 http://www.vupen.com/english/advisories/2010/3056 http://secunia.com/advisories/42368 http://www.debian.org/security/2011/dsa-2207 http://marc.info/?l=bugtraq&m=136485229118404&w=2 http://marc.info/?l=bugtraq&m=133469267822771&w=2 http://marc.info/?l=bugtraq&m=127420533226623&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/50930 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6628 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915 http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.securityfocus.com/archive/1/504125/100/0/threaded http://www.securityfocus.com/archive/1/504108/100/0/threaded http://www.securityfocus.com/archive/1/504045/100/0/threaded https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E https://access.redhat.com/errata/RHSA-2009:1145 https://nvd.nist.gov https://www.exploit-db.com/exploits/33023/https://www.rapid7.com/db/modules/auxiliary/scanner/http/tomcat_enum https://www.securityfocus.com/bid/35196 http://tools.cisco.com/security/center/viewAlert.x?alertId=18331 https://usn.ubuntu.com/788-1/

CVE-2009-0580

Vulnerability Summary

Most Upvoted Vulmon Research Post

Vendor Advisories

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect