The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.33. It is, therefore, affected by multiple vulnerabilities :

  - Several weaknesses were found in the HTTP Digest     authentication implementation. The issues are as     follows: replay attacks are possible, server nonces     are not checked, client nonce counts are not checked,     'quality of protection' (qop) values are not checked,     realm values are not checked and the server secret is     a hard-coded, known string. The effect of these issues     is that Digest authentication is no stronger than Basic     authentication. (CVE-2011-1184, CVE-2011-5062,     CVE-2011-5063, CVE-2011-5064)

  - An error handling issue exists related to the     MemoryUserDatabase that allows user passwords to be     disclosed through log files. (CVE-2011-2204)

  - An input validation error exists that allows a local     attacker to either bypass security or carry out denial     of service attacks when the APR or NIO connectors are     enabled. (CVE-2011-2526)

  - A component that Apache Tomcat relies on called 'jsvc'     contains an error in that it does not drop capabilities     after starting and can allow access to sensitive files     owned by the super user. Note this vulnerability only     affects Linux operating systems and only when the     following are true: jsvc is compiled with libpcap and     the '-user' parameter is used. (CVE-2011-2729)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.34. It is, there, affected by multiple vulnerabilities :

  - Several weaknesses were found in the HTTP Digest     authentication implementation. The issues are as     follows: replay attacks are possible, server nonces     are not checked, client nonce counts are not checked,     'quality of protection' (qop) values are not checked,     realm values are not checked and the server secret is     a hard-coded, known string. The effect of these issues     is that Digest authentication is no stronger than Basic     authentication. (CVE-2011-1184, CVE-2011-5062,     CVE-2011-5063, CVE-2011-5064)

  - An error handling issue exists related to the     MemoryUserDatabase that allows user passwords to be     disclosed through log files. (CVE-2011-2204)

  - An input validation error exists that allows a local     attacker to either bypass security or carry out denial     of service attacks when the APR or NIO connectors are     enabled. (CVE-2011-2526)

  - A component that Apache Tomcat relies on called 'jsvc'     contains an error in that it does not drop capabilities     after starting and can allow access to sensitive files     owned by the super user. Note this vulnerability only     affects Linux operating systems and only when 'jsvc' is     compiled with libpcap and the '-user' parameter is     used. (CVE-2011-2729)

  - Specially crafted requests are incorrectly processed by     Tomcat and can cause the server to allow injection of     arbitrary AJP messages. This can lead to authentication     bypass and disclosure of sensitive information. Note     this vulnerability only occurs when the     org.apache.jk.server.JkCoyoteHandler AJP connector is     not used, POST requests are accepted, and the request     body is not processed.(CVE-2011-3190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

jsvc did not properly drop capabilities, therefore allowing applications to access files owned by the super user (CVE-2011-2729).

This update fixes several bugs and also security issue CVE-2011-2729.

Users are encouraged to update as soon as possible.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the instance of Apache Tomcat 7.x listening on the remote host is prior to 7.0.20. It is, therefore, affected by an information disclosure vulnerability due to a component that Apache Tomcat relies on called 'jsvc' which does not drop capabilities after starting and can allow access to sensitive files owned by the super user.

Note that this vulnerability only affects Linux operating systems and only when the following are true :

  - jsvc is compiled with libpcap

  - the '-user' parameter is used

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Wilfried Weissmann discovered that Apache Commons Daemon incorrectly dropped capabilities after starting. A remote attacker could possibly use this flaw to read certain files, bypassing the intended permissions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Tomcat 7.0.x earlier than 7.0.20 are potentially affected by an information disclosure vulnerability.  A component that Apache Tomcat relies on called 'jsvc' contains an error in that it does not drop capabilities after starting and can allow access to sensitive files owned by the super user.  Note that this vulnerability only affects Linux operating systems and only when the following are true : 

  - jsvc is compiled with libpcap.

  - The '-user' parameter is used

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of Tomcat 6.x earlier than 6.0.33 are potentially affected by multiple vulnerabilities : 

  - An error handling issue exists related to the MemoryUserDatabase that allows user passwords to be disclosed through log files. (CVE-2011-2204)

  - An input validation error exists that allows a local attacker to either bypass security or carry out denial of service attacks when the APR or NIO connectors are enabled. (CVE-2011-2526)

  - A component that Apache Tomcat relies on called 'jsvc' contains an error in that it does not drop capabilities after starting and can allow access to sensitive files owned by the super user.  Note this vulnerability only affects Linux operating systems and only when the following are true:  jsvc is compiled with libpcap and the '-user' parameter is used. (CVE-2011-2729)

Versions of Tomcat 7.0.x earlier than 7.0.20 are potentially affected by an information disclosure vulnerability.  A component that Apache Tomcat relies on called 'jsvc' contains an error in that it does not drop capabilities after starting and can allow access to sensitive files owned by the super user.  Note that this vulnerability only affects Linux operating systems and only when the following are true : 

  - jsvc is compiled with libpcap.

  - The '-user' parameter is used

ID	Name	Product	Family	Published	Updated	Severity
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/25/2012	1/6/2021	medium
56008	Apache Tomcat 6.0.x < 6.0.33 Multiple Vulnerabilities	Nessus	Web Servers	8/30/2011	4/11/2022	medium
56301	Apache Tomcat 5.5.x < 5.5.34 Multiple Vulnerabilities	Nessus	Web Servers	9/26/2011	4/11/2022	high
75868	openSUSE Security Update : jakarta-commons-daemon (openSUSE-SU-2011:1062-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
55962	Fedora 16 : apache-commons-daemon-1.0.7-1.fc16 (2011-10880)	Nessus	Fedora Local Security Checks	8/24/2011	1/11/2021	medium
55988	Fedora 15 : apache-commons-daemon-1.0.7-1.fc15 (2011-10936)	Nessus	Fedora Local Security Checks	8/29/2011	1/11/2021	medium
55859	Apache Tomcat 7.x < 7.0.20 'jsvc' Information Disclosure	Nessus	Web Servers	8/16/2011	4/11/2022	medium
57271	Ubuntu 11.04 / 11.10 : commons-daemon vulnerability (USN-1298-1)	Nessus	Ubuntu Local Security Checks	12/13/2011	9/19/2019	medium
6007	Apache Tomcat 7.0.x < 7.0.20 'jsvc' Information Disclosure	Nessus Network Monitor	Web Servers	8/16/2011	3/6/2019	medium
800602	Apache Tomcat 6.0.x < 6.0.33 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	8/30/2011		medium
800615	Apache Tomcat 7.0.x < 7.0.20 'jsvc' Information Disclosure	Log Correlation Engine	Web Servers	8/16/2011		medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium