Published: 17/11/2012 Updated: 19/09/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x prior to 5.5.36, 6.x prior to 6.0.36, and 7.x prior to 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote malicious users to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 5.5.0
apache tomcat 5.5.25
apache tomcat 5.5.33
apache tomcat 5.5.7
apache tomcat 5.5.18
apache tomcat 5.5.15
apache tomcat 5.5.3
apache tomcat 5.5.22
apache tomcat 5.5.2
apache tomcat 5.5.35
apache tomcat 5.5.30
apache tomcat 5.5.9
apache tomcat 5.5.8
apache tomcat 5.5.29
apache tomcat 5.5.31
apache tomcat 5.5.17
apache tomcat 5.5.12
apache tomcat 5.5.24
apache tomcat 5.5.21
apache tomcat 5.5.19
apache tomcat 5.5.10
apache tomcat 5.5.1
apache tomcat 5.5.34
apache tomcat 5.5.6
apache tomcat 5.5.16
apache tomcat 5.5.13
apache tomcat 5.5.23
apache tomcat 5.5.26
apache tomcat 5.5.28
apache tomcat 5.5.27
apache tomcat 5.5.5
apache tomcat 5.5.4
apache tomcat 5.5.14
apache tomcat 5.5.11
apache tomcat 5.5.32
apache tomcat 5.5.20
apache tomcat 6.0.9
apache tomcat 6.0.8
apache tomcat 6.0.33
apache tomcat 6.0.4
apache tomcat 6.0.18
apache tomcat 6.0.1
apache tomcat 6.0.32
apache tomcat 6.0.24
apache tomcat 6.0.19
apache tomcat 6.0.16
apache tomcat 6.0.6
apache tomcat 6.0.7
apache tomcat 6.0.17
apache tomcat 6.0.0
apache tomcat 6.0.26
apache tomcat 6.0.2
apache tomcat 6.0.10
apache tomcat 6.0.20
apache tomcat 6.0.15
apache tomcat 6.0.28
apache tomcat 6.0.5
apache tomcat 6.0.13
apache tomcat 6.0.31
apache tomcat 6.0.35
apache tomcat 6.0.30
apache tomcat 6.0
apache tomcat 6.0.14
apache tomcat 6.0.29
apache tomcat 6.0.27
apache tomcat 6.0.3
apache tomcat 6.0.12
apache tomcat 6.0.11
apache tomcat 7.0.18
apache tomcat 7.0.15
apache tomcat 7.0.11
apache tomcat 7.0.2
apache tomcat 7.0.25
apache tomcat 7.0.16
apache tomcat 7.0.6
apache tomcat 7.0.21
apache tomcat 7.0.14
apache tomcat 7.0.10
apache tomcat 7.0.12
apache tomcat 7.0.4
apache tomcat 7.0.8
apache tomcat 7.0.28
apache tomcat 7.0.23
apache tomcat 7.0.1
apache tomcat 7.0.0
apache tomcat 7.0.7
apache tomcat 7.0.19
apache tomcat 7.0.13
apache tomcat 7.0.5
apache tomcat 7.0.20
apache tomcat 7.0.17
apache tomcat 7.0.3
apache tomcat 7.0.22
apache tomcat 7.0.9

Several security issues were fixed in Apache Tomcat ...

Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Application Platform 520which fix multiple security issues are now available for Red HatEnterprise Linux 4, 5, and 6The Red Hat Security Response Team has rated this ...

Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Application Platform 601that fix multiple security issues are now available for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated this updat ...

Synopsis Important: tomcat6 security update Type/Severity Security Advisory: Important Topic Updated tomcat6 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerab ...

Synopsis Important: tomcat5 security update Type/Severity Security Advisory: Important Topic Updated tomcat5 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerab ...

Synopsis Important: JBoss Enterprise SOA Platform 531 update Type/Severity Security Advisory: Important Topic JBoss Enterprise SOA Platform 531 roll up patch 1, which fixes multiplesecurity issues and various bugs, is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has r ...

Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic Updated tomcat6 packages that fix multiple security issues are nowavailable for JBoss Enterprise Web Server 200 for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated this update as having ...

Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic An update for JBoss Enterprise Application Platform 520 which fixesmultiple security issues is now available from the Red Hat Customer PortalThe Red Hat Security Response Team has rated this update as having moder ...

Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic An update for the Apache Tomcat 6 component for JBoss Enterprise Web Server200 that fixes multiple security issues is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has rated this u ...

Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Web Platform 520 whichfix multiple security issues are now available for Red Hat Enterprise Linux4, 5, and 6The Red Hat Security Response Team has rated this update a ...

CWE-264 http://tomcat.apache.org/security-7.html http://svn.apache.org/viewvc?view=revision&revision=1377807 http://svn.apache.org/viewvc?view=revision&revision=1392248 http://tomcat.apache.org/security-6.html http://svn.apache.org/viewvc?view=revision&revision=1380829 http://tomcat.apache.org/security-5.html http://www.ubuntu.com/usn/USN-1637-1 http://www.securityfocus.com/bid/56403 http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html http://rhn.redhat.com/errata/RHSA-2013-0640.html http://rhn.redhat.com/errata/RHSA-2013-0631.html http://rhn.redhat.com/errata/RHSA-2013-0632.html http://rhn.redhat.com/errata/RHSA-2013-0633.html http://rhn.redhat.com/errata/RHSA-2013-0623.html http://rhn.redhat.com/errata/RHSA-2013-0629.html http://rhn.redhat.com/errata/RHSA-2013-0647.html http://rhn.redhat.com/errata/RHSA-2013-0726.html http://rhn.redhat.com/errata/RHSA-2013-0648.html http://secunia.com/advisories/51371 http://marc.info/?l=bugtraq&m=136485229118404&w=2 http://www-01.ibm.com/support/docview.wss?uid=swg21626891 http://marc.info/?l=bugtraq&m=136612293908376&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/80408 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19432 https://usn.ubuntu.com/1637-1/https://nvd.nist.gov

Get Started

CVE-2012-5885

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect