SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Apache Tomcat Realm Authentication Timing Lets Remote Users Determine Valid Usernames on the Target System
SecurityTracker Alert ID:  1037144
SecurityTracker URL:  http://securitytracker.com/id/1037144
CVE Reference:   CVE-2016-0762   (Links to External Site)
Date:  Oct 28 2016
Impact:   Disclosure of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.0.0 to 6.0.45, 7.0.0 to 7.0.70, 8.0.0.RC1 to 8.0.36, 8.5.0 to 8.5.4, 9.0.0.M1 to 9.0.0.M9
Description:   A vulnerability was reported in Apache Tomcat. A remote user can determine valid usernames on the target system.

The Realm implementation does not process the user supplied password if the specified user name does not exist. As a result, a remote user can conduct a timing attack to determine valid usernames on the target system.

Impact:   A remote user can determine valid usernames on the target system.
Solution:   The vendor has issued a fix (6.0.47, 7.0.72, 8.0.37, 8.5.5, 9.0.0.M10).

The vendor advisories are available at:

http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html

Vendor URL:  tomcat.apache.org/security-8.html (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jan 18 2017 (IBM Issues Fix for IBM Rational License Key Server) Apache Tomcat Realm Authentication Timing Lets Remote Users Determine Valid Usernames on the Target System
IBM has issued a fix for IBM Rational License Key Server Administration and Reporting Tool.
Aug 3 2017 (Red Hat Issues Fix) Apache Tomcat Realm Authentication Timing Lets Remote Users Determine Valid Usernames on the Target System
Red Hat has issued a fix for Red Hat Enterprise Linux 7.



 Source Message Contents

Subject:  [oss-security] [SECURITY] CVE-2016-0762 Apache Tomcat Realm Timing Attack

CVE-2016-0762 Apache Tomcat Realm Timing Attack

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M9
Apache Tomcat 8.5.0 to 8.5.4
Apache Tomcat 8.0.0.RC1 to 8.0.36
Apache Tomcat 7.0.0 to 7.0.70
Apache Tomcat 6.0.0 to 6.0.45
Earlier, unsupported versions may also be affected.

Description
The Realm implementations did not process the supplied password if the
supplied user name did not exist. This made a timing attack possible to
determine valid user names. Note that the default configuration includes
the LockOutRealm which makes exploitation of this vulnerability harder.

Mitigation
Users of affected versions should apply one of the following mitigations
- Upgrade to Apache Tomcat 9.0.0.M10 or later
- Upgrade to Apache Tomcat 8.5.5 or later
- Upgrade to Apache Tomcat 8.0.37 or later
- Upgrade to Apache Tomcat 7.0.72 or later
  (Apache Tomcat 7.0.71 has the fix but was not released)
- Upgrade to Apache Tomcat 6.0.47 or later
  (Apache Tomcat 6.0.46 has the fix but was not released)

Credit:
This issue was discovered by The Apache Tomcat Security Team.

References:
[1] http://tomcat.apache.org/security-9.html
[2] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html
[4] http://tomcat.apache.org/security-6.html
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC