The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0680 advisory.

  - tomcat: Multiple weaknesses in HTTP DIGEST authentication (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063,     CVE-2011-5064)

  - tomcat: password disclosure vulnerability (CVE-2011-2204)

  - tomcat: security manager restrictions bypass (CVE-2011-2526)

  - tomcat: authentication bypass and information disclosure (CVE-2011-3190)

  - tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) (CVE-2011-4858)

  - tomcat: large number of parameters DoS (CVE-2012-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 / 6 : tomcat5 (RHSA-2012:0680)

high Nessus Plugin ID 78924

Version 1.13