CVE-2012-5887: Improper Authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended...

CVE-2012-5885: Undefined Security Weakness

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce aka client nonce values instead of nonce aka server nonce and nc aka nonce-count values, which makes it easi...

FreeBSD : tomcat -- authentication weaknesses (152e4c7e-2a2e-11e2-99c7-00a0d181e71d)

The Apache Software Foundation reports : Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved : - Tomcat tracked client rather than server nonces and nonce count. - When a session ID was present, authentication was bypassed. - The user name and passwor...

Apache Tomcat DIGEST身份验证多个安全漏洞(CVE-2012-3439)

BUGTRAQ ID: 56403 CVE ID: CVE-2012-3439 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat 7.0.0-7.0.27、6.0.0-6.0.35、5.5.0-5.5.35存在多个安全漏洞，成功利用后可允许攻击者绕过安全限制并执行非法操作。 0 Apache Group Tomcat 7.x Apache Group Tomcat 6.x Apache Group Tomcat 5.x 厂商补丁： Apache Group ------------ 请更新到5.5.36、6.0.36、7.0.30...

tomcat -- authentication weaknesses

The Apache Software Foundation reports: Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved: Tomcat tracked client rather than server nonces and nonce count. When a session ID was present, authentication was bypassed. The user name and password were n...

PT-2012-4712 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat affected versions not specified Description: The issue concerns weaknesses in Tomcat's implementation of DIGEST authentication. Specifically, Tomcat tracked client rather than server nonces and nonce count, which reduced the...

Fixed in Apache Tomcat 6.0.36

Important: Denial of service CVE-2012-2733 The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large...

Novell File Reporter NFRAgent.exe VOL tag buffer overflow

Added: 10/12/2012 BID: 55268 OSVDB: 85503 Background Novell File Reporter is software that allows network administrators to identify files stored on the network and generates reports regarding the size of individual files, file type, when files were last accessed, and where duplicates exist...

Novell File Reporter NFRAgent.exe VOL tag buffer overflow

Added: 10/12/2012 BID: 55268 OSVDB: 85503 Background Novell File Reporter is software that allows network administrators to identify files stored on the network and generates reports regarding the size of individual files, file type, when files were last accessed, and where duplicates exist...

Fixed in Apache Tomcat 5.5.36

Moderate: DIGEST authentication weakness CVE-2012-3439 Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved: 1. Tomcat tracked client rather than server nonces and nonce count. 2. When a session ID was present, authentication was bypassed. 3. The user...

Forthcoming SHA-3 Hash Function May Be Unnecessary

For the last five years, NIST, the government body charged with developing new standards for computer security, among other things, has been searching for a new hash function to replace the aging SHA-2 function. Fives years is a long time, but this is the federal government and things move at the...

CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

DEBIAN-CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

Stack overflow

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

CVE-2012-1184

Stack-based buffer overflow in the astparsedigest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header...

PT-2012-3113

Name of the Vulnerable Software and Affected Versions Asterisk versions 1.8.x through 1.8.10.0 Asterisk versions 10.x through 10.2.0 Description The issue is related to a stack-based buffer overflow in the ast parse digest function, which can be triggered by a long string in an HTTP Digest...