Description
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tomcat6 +8 | 6.0.24-52.el6_4 | RHSA-2013:0623 |
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.38.el5_9 | RHSA-2013:0640 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | tomcat6 +9 | 6.0.35-6_patch_06.ep6.el5 | RHSA-2013:0266 |
| Red Hat JBoss Web Platform 5 | jbossweb +4 | 2.1.13-3_patch_02.ep5.el5 | RHSA-2013:0631 |
| Red Hat JBoss EAP 6 | jbossweb +1 | 7.0.17-4.Final_redhat_3.ep6.el5 | RHSA-2013:0647 |
| Red Hat JBoss EAP 5 | jbossweb +4 | 2.1.13-3_patch_02.ep5.el4 | RHSA-2013:0629 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.36 | 5.5.36 | GHSA-99rf-92v6-cwx4 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.36 | 6.0.36 | GHSA-99rf-92v6-cwx4 |
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.30 | 7.0.30 | GHSA-99rf-92v6-cwx4 |
Advisories 6
- RHSA-2013:0647 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0640 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0631 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0623 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0629 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0266 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21626891
- SSRT101139 vendor-advisory
- 51371 third-party-advisory
- oval:org.mitre.oval:def:19432 vdb-entry signature
- openSUSE-SU-2012:1700 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1392248
- HPSBUX02860 vendor-advisory
- RHSA-2013:0631 vendor-advisory
- RHSA-2013:0640 vendor-advisory
- USN-1637-1 vendor-advisory
- 56403 vdb-entry
- http://tomcat.apache.org/security-7.html
- RHSA-2013:0648 vendor-advisory
- RHSA-2013:0633 vendor-advisory
- RHSA-2013:0629 vendor-advisory
- RHSA-2013:0647 vendor-advisory
- RHSA-2013:0632 vendor-advisory
- http://tomcat.apache.org/security-6.html
- http://svn.apache.org/viewvc?view=revision&revision=1380829
- openSUSE-SU-2013:0147 vendor-advisory
- RHSA-2013:0623 vendor-advisory
- http://tomcat.apache.org/security-5.html
- tomcat-replay-security-bypass(80408) vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=1377807
- openSUSE-SU-2012:1701 vendor-advisory
- RHSA-2013:0726 vendor-advisory