Apache Tomcat v. 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 information disclosure vulnerability

                                                CVE-2010-1157: Apache Tomcat information disclosure vulnerability
 
Severity: Low
 
Vendor: The Apache Software Foundation
 
Versions Affected:
 
- - Tomcat 6.0.0 to 6.0.26
 
- - Tomcat 5.5.0 to 5.5.29
 
Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be
affected.
 
 
Description:
 
The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a
realm name. If a <realm-name> element is specified for the application in
web.xml it will be used. However, a <realm-name> is not specified then
Tomcat will generate one using the code snippet:
 
request.getServerName() + ":" + request.getServerPort() In some
circumstances this can expose the local hostname or IP address of the
machine running Tomcat.
 
Example:
 
GET /application/j_security_check HTTP/1.0
 
 
HTTP/1.1 401 Unauthorized
 
Server: Apache-Coyote/1.1
 
WWW-Authenticate: Basic realm="tomcat01:8080"
 
Content-Type: text/html;charset=utf-8
 
Content-Length: 954
 
Date: Thu, 31 Dec 2009 12:18:11 GMT
 
Connection: close
 
 
Mitigation:
 
Administrators of web applications that use BASIC or DIGEST authentication
are recommended to set an appropriate realm name in the web application's
web.xml file.
 
Alternatively, the following patches may be used to change the default realm
to "Authentication required" (without the quotes):
 
- - Tomcat 6.0.x: http://svn.apache.org/viewvc?view=rev&rev=936540
 
- - Tomcat 5.5.x: http://svn.apache.org/viewvc?view=rev&rev=936541
 
These patches will be included in the next releases of Tomcat 5.5.x and
Tomcat 6.0.x. No release date has been set for the next Tomcat 5.5.x and
Tomcat 6.0.x releases.
 
Credit:
 
This issue was discovered by Deniz Cevik.
 
 
References:
 
http://tomcat.apache.org/security.html
 
http://tomcat.apache.org/security-6.html
 
http://tomcat.apache.org/security-5.html