Ubuntu 10.04 LTS / 11.10 / 12.04 LTS : tomcat6 vulnerabilities (USN-1637-1)

It was discovered that the Apache Tomcat HTTP NIO connector incorrectly handled header data. A remote attacker could cause a denial of service by sending requests with a large amount of header data. CVE-2012-2733 It was discovered that Apache Tomcat incorrectly handled DIGEST authentication. A...

Ubuntu Update for tomcat6 USN-1637-1

Ubuntu Update for Linux kernel vulnerabilities USN-1637-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN16371.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for tomcat6 USN-1637-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu: Security Advisory (USN-1637-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1637-1: Tomcat vulnerabilities

It was discovered that the Apache Tomcat HTTP NIO connector incorrectly handled header data. A remote attacker could cause a denial of service by sending requests with a large amount of header data. CVE-2012-2733 It was discovered that Apache Tomcat incorrectly handled DIGEST authentication. A...

PT-2012-5058

Name of the Vulnerable Software and Affected Versions AirDroid version 1.0.4 beta Description The issue allows remote attackers to gain access by sniffing the local wireless network and replaying the authentication data. This is due to the implementation of authentication through direct...

CVE-2012-3884: Improper Authentication

AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data...

EMC RSA Access Manager replay attack

It's possible to replays sniffed session...

Design/Logic Flaw

EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors...

PT-2012-3920

Name of the Vulnerable Software and Affected Versions EMC RSA Access Manager Server versions prior to 6.1 SP4 EMC RSA Access Manager Agent affected versions not specified Description The issue is related to improper validation of session tokens after a logout, which could allow remote attackers t...

CVE-2012-2281: Improper Authentication

EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors...

Authentication flaw

The agent in Bradford Network Sentry before 5.3.3 does not require authentication for messages, which allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to UDP port 4567, as demonstrated by a replay attack...

CVE-2012-2606

Bradford Network Sentry before 5.3.3 contains an authentication flaw in the agent listening on UDP port 4567. The lack of authentication allows a remote attacker to trigger the display of arbitrary text on a workstation via a crafted UDP packet, demonstrated by a replay attack. Affected product i...

PT-2012-4132

Name of the Vulnerable Software and Affected Versions Bradford Network Sentry versions prior to 5.3.3 Description The issue allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to "UDP port 4567", as demonstrated by a replay attack, due to the lac...

CVE-2012-2606: Improper Authentication

The agent in Bradford Network Sentry before 5.3.3 does not require authentication for messages, which allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to UDP port 4567, as demonstrated by a replay attack...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

krb5 security and bug fix update

1.6.1-70.el5 - add upstream patch for telnetd buffer overflow CVE-2011-4862, 770351 1.6.1-69.el5 - ftp: fix a static analysis should-never-happen NULL dereference 750823 1.6.1-68.el5 - backport fixes to teach libkrb5 to use descriptors higher than FDSETSIZE to talk to a KDC by using poll if it's...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

CVE-2011-1184

The vulnerability CVE-2011-1184 affects Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12. The HTTP Digest Access Authentication implementation has insufficient replay-attack countermeasures due to lack of proper nonce and nc (nonce-count) checking, which can allow remot...