[SECURITY] CVE-2011-2204 - Apache Tomcat information disclosure

[Mark Thomas <ma...@apache.org>]

CVE-2011-2204 Apache Tomcat information disclosure

Severity: Low
Vendor: The Apache Software Foundation

Versions Affected:
- Tomcat 7.0.0 to 7.0.16
- Tomcat 6.0.0 to 6.0.32
- Tomcat 5.5.0 to 5.5.33
Earlier, unsupported versions may also be affected

Description:
When using the MemoryUserDatabase (based on tomcat-users.xml) and
creating users via JMX, an exception during the user creation process
may trigger an error message in the JMX client that includes the user's
password. This error message is also written to the Tomcat logs. User
passwords are visible to administrators with JMX access and/or
administrators with read access to the tomcat-users.xml file. Users that
do not have these permissions but are able to read log files may be able
to discover a user's password.

Steps to reproduce:
The Tomcat security team has been unable to reproduce this error without
forcing an exception by modifying the Tomcat source code. In theory, an
OutOfMemoryError at exactly the right point could trigger this
vulnerability.

Mitigation:
Users of affected versions should apply one of the following mitigations:
- Don't manage the MemoryUserDatabase via JMX
- Use digested passwords
- Limit access to Tomcat log files
- Upgrade to a Tomcat 7.0.17, 6.0.33 or 5.5.34 or later once released
- Apply the appropriate patch
  - 7.0.x: http://svn.apache.org/viewvc?rev=1140070&view=rev
  - 6.0.x: http://svn.apache.org/viewvc?rev=1140071&view=rev
  - 5.5.x: http://svn.apache.org/viewvc?rev=1140072&view=rev

Credit:
This issue was identified by Polina Genova and reported privately to the
Tomcat Security Team via security@tomcat.apache.org.

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org