The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header,     which makes it easier for remote attackers to hijack a session via script access to a cookie.
    (CVE-2010-4312)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.30. It is, therefore, affected by multiple vulnerabilities :

  - An error in the access restriction on a 'ServletContext'     attribute that holds the location of the work directory     in Tomcat's SecurityManager. A malicious web application     can modify the location of the working directory which     then allows improper read and write access to arbitrary     files and directories in the context of Tomcat.
    (CVE-2010-3718)

  - An input validation error exists in the Manager     application in that it fails to filter the 'sort' and     'orderBy' input parameters. (CVE-2010-4172)

  - The default configuration does not include the HTTPOnly     flag in a Set-Cookie header, which makes it easier for     remote attackers to hijack a session via script access     to a cookie. (CVE-2010-4312)

  - An input validation error exists in the HTML manager     application in that it fails to filter various input     data before returning it to the browser. (CVE-2011-0013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
217399	Linux Distros Unpatched Vulnerability : CVE-2010-4312	Nessus	Misc.	critical
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
51975	Apache Tomcat 6.0.x < 6.0.30 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2010-4312

medium

Tenable Plugins

critical

medium

medium