Tomcat Single Quote Cookie Processing Bug Lets Remote Users Obtain Session Information
|
|
SecurityTracker Alert ID: 1018556
|
|
SecurityTracker URL: http://securitytracker.com/id?1018556
|
|
CVE Reference: CVE-2007-3382
(Links to External Site)
|
Date: Aug 14 2007
|
Impact: Disclosure of system information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 3.3 to 3.3.2, 4.1.0 to 4.1.36, 5.0.0 to 5.0.30, 5.5.0 to 5.5.24, 6.0.0 to 6.0.13
|
Description: A vulnerability was reported in Tomcat. A remote user can obtain session information.
The software incorrectly interprets a single quote (') character in a cookie value as a delimiter. A remote user may be able to
exploit this to hijack sessions.
A demonstration exploit URL is provided:
http://[target]:8080/servlets-examples/servlet/CookieExample?cookiename=BLOCKER&cookievalu
e=%5C%22A%3D%27%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC%3B+Path%3D%2Fservlets-examples%2Fservlet+%3B
Tomasz Kuczynski,
Poznan Supercomputing and Networking Center and CERT/CC reported this vulnerability.
|
Impact: A remote user can may be able to hijack sessions.
|
Solution: The vendor has issued a fixed version (6.0.14).
|
Vendor URL: tomcat.apache.org/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Mark Thomas <markt@apache.org>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 13 Aug 2007 23:28:21 -0400
From: Mark Thomas <markt@apache.org>
Subject: CVE-2007-3382: Handling of cookies containing a ' character
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2007-3382: Handling of cookies containing a ' character
Severity:
Low (Session Hi-jacking)
Vendor:
The Apache Software Foundation
Versions Affected:
6.0.0 to 6.0.13
5.5.0 to 5.5.24
5.0.0 to 5.0.30
4.1.0 to 4.1.36
3.3 to 3.3.2
Description:
Tomcat incorrectly treats a single quote character (') in a cookie
value as a delimiter. In some circumstances this can lead to the
leaking of information such as session ID to an attacker.
Mitigation:
Upgrade to 6.0.14
Credit:
This issue was discovered by Tomasz Kuczynski, Poznan Supercomputing
and Networking Center, who worked with the CERT/CC to report the
vulnerability.
Example:
http://localost:8080/servlets-examples/servlet/CookieExample?cookiename=BLOCKER&cookievalue=%5C%2
2A%3D%27%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC%3B+Path%3D%2Fservlets-examples%2Fservlet+%3B
References:
http://tomcat.apache.org/security.html
Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGwSFVb7IeiTPGAkMRAjkwAKDnu+C08WRZazmZfzunFeHcitsvnACg3CtP
6c6FCxbFOcfxhqqayg8kdUI=
=MkDj
-----END PGP SIGNATURE-----
|
|
