Lucene search
RootSSV:19510HistoryApr 26, 2010 - 12:00 a.m.
Apache Tomcat认证头信息泄露漏洞
2010-04-2600:00:00
Root
www.seebug.org
29
0.16 Low
EPSS
Percentile
95.4%
BUGTRAQ ID: 39635
CVE ID: CVE-2010-1157
Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。
BASIC和DIGEST认证的WWW-Authenticate头包含有区域名。如果web.xml中对应用指定了<realm- name>元素，就会使用指定的区域名，否则Tomcat就会使用以下代码段生成一个区域名：
request.getServerName() + ":" + request.getServerPort()
在某些环境中这可能会暴露运行Tomcat机器的本地主机名或IP地址。
Apache Group Tomcat 6.0.x
Apache Group Tomcat 5.5.x
厂商补丁：
Apache Group
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://svn.apache.org/viewvc?view=rev&rev=936540
http://svn.apache.org/viewvc?view=rev&rev=936541
HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
WWW-Authenticate: Basic realm="tomcat01:8080"
Content-Type: text/html;charset=utf-8
Content-Length: 954
Date: Thu, 31 Dec 2009 12:18:11 GMT
Connection: close
Related
exploitpack
exploitpack
Apache Tomcat 5.5.0 5.5.29 6.0.0 6.0.26 - Information Disclosure
2010-04-22 00:00:00
openvas
openvas
Apache Tomcat Security bypass vulnerability
2010-04-29 00:00:00
FreeBSD Ports: tomcat
2010-05-04 00:00:00
FreeBSD Ports: tomcat
2010-05-04 00:00:00
nessus
nessus
FreeBSD : tomcat -- information disclosure vulnerability (3383e706-4fc3-11df-83fb-0015587e2cc1)
2010-04-26 00:00:00
openSUSE Security Update : tomcat6 (openSUSE-SU-2010:0616-1)
2014-06-13 00:00:00
SuSE9 Security Update : Tomcat (YOU Patch Number 12625)
2010-09-16 00:00:00
osv
osv
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
2022-05-02 06:19:37
cve
cve
CVE-2010-1157
2010-04-23 14:30:00
seebug
seebug
freebsd
freebsd
tomcat -- information disclosure vulnerability
2010-04-22 00:00:00
github
github
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
2022-05-02 06:19:37
ubuntucve
ubuntucve
CVE-2010-1157
2010-04-23 00:00:00
securityvulns
securityvulns
[SECURITY] CVE-2010-1157: Apache Tomcat information disclosure vulnerability
2010-04-23 00:00:00
Apache Tomcat information leak
2010-04-23 00:00:00
Apple OS X multiple security vulnerabilities
2011-10-24 00:00:00
prion
prion
Authentication flaw
2010-04-23 14:30:00
exploitdb
exploitdb
Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure
2010-04-22 00:00:00
redhat
redhat
(RHSA-2010:0584) Important: jbossweb security update
2010-08-02 00:00:00
(RHSA-2011:0897) Moderate: JBoss Enterprise Web Server 1.0.2 update
2011-06-22 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 6.0.28
2010-07-09 00:00:00
Fixed in Apache Tomcat 5.5.30
2010-07-09 00:00:00
debian
debian
[SECURITY] [DSA 2207-1] tomcat5.5 security update
2011-03-29 22:35:34
gentoo
gentoo
Apache Tomcat: Multiple vulnerabilities
2012-06-24 00:00:00
ibm
ibm