Guest

Preview Tool

Cisco Bug: CSCun25933 - Show and Share Apache Vulnerability

Last Modified

Dec 29, 2019

Products (1)

  • Cisco Digital Media Manager

Known Affected Releases

5.3

Description (partial)

Symptom:
Cisco Show and Share includes a version of Tomcat that is affected by the vulnerabilities identified by the
following Common Vulnerability and Exposures (CVE) IDs:

CVE-2011-0534: Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the
maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause
a denial of service (OutOfMemoryError) via a crafted request. This has been classified by the vendor as having
a CVSSv2 score of 5.0 (AV:N/AC:L/AU:N/C:N/I:N/A:P)

CVE-2011-1184: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x
before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which
makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid
requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce
count) values. This has been classified by the vendor as having a CVSSv2 score of 5.0
(AV:N/AC:L/AU:N/C:P/I:N/A:N)

CVE-2011-2204: Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the
MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user
creation, which allows local users to obtain sensitive information by reading a log file. This has been
classified by the vendor as having a CVSSv2 score of 1.9 (AV:L/AC:M/AU:N/C:P/I:N/A:N)

CVE-2011-2481: Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for
other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3)
tld files of arbitrary web applications via a crafted application that is loaded earlier than the target
application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression. This has been classified
by the vendor as having a CVSSv2 score of 4.6 (AV:L/AC:L/AU:N/C:P/I:P/A:P)

CVE-2011-2526: Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is
enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows
local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM
crash) by leveraging an untrusted web application. This has been classified by the vendor as having a CVSSv2
score of 4.4 (AV:L/AC:M/AU:N/C:P/I:P/A:P)

CVE-2011-2729: native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache
Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on
Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a
request to an application. This has been classified by the vendor as having a CVSSv2 score of 5.0
(AV:N/AC:L/AU:N/C:P/I:N/A:N)

CVE-2011-3190: Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0
through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP
requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a
request body as a new request. This has been classified by the vendor as having a CVSSv2 score of 7.5
(AV:N/AC:L/AU:N/C:P/I:P/A:P)

CVE-2011-5062: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x
before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass
intended integrity-protection requirements via a qop=auth value, a different vulnerability than
CVE-2011-1184. This has been classified by the vendor as having a CVSSv2 score of 5.0
(AV:N/AC:L/AU:N/C:P/I:N/A:N)

CVE-2011-5063: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x
before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass
intended access restrictions by leveraging the availability of a protection space with weaker authentication
or authorization requirements, a different vulnerability than CVE-2011-1184. This has been classified by the
vendor as having a CVSSv2 score of 4.3 (AV:N/AC:M/AU:N/C:P/I:N/A:N)

CVE-2011-5064: DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache
Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server
secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection
mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. This has been
classified by the vendor as having a CVSSv2 score of 4.3 (AV:N/AC:M/AU:N/C:P/I:N/A:N)

CVE-2012-2733: java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache
Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which
allows remote attackers to cause a denial of service (memory consumption) via a large amount of header
data. This has been classified by the vendor as having a CVSSv2 score of 5.0 (AV:N/AC:L/AU:N/C:N/I:N/A:P)

CVE-2012-3544: Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions
in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data. This
has been classified by the vendor as having a CVSSv2 score of 5.0 (AV:N/AC:L/AU:N/C:N/I:N/A:P)

CVE-2012-3546: org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before
7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by
leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. This has
been classified by the vendor as having a CVSSv2 score of 4.3 (AV:N/AC:M/AU:N/C:N/I:P/A:N)

CVE-2012-4431: org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and
7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism
via a request that lacks a session identifier. This has been classified by the vendor as having a CVSSv2 score
of 4.3 (AV:N/AC:M/AU:N/C:N/I:P/A:N)

CVE-2012-4534: org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before
7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to
cause a denial of service (infinite loop) by terminating the connection during the reading of a response. This
has been classified by the vendor as having a CVSSv2 score of 2.6 (AV:N/AC:H/AU:N/C:N/I:N/A:P)

CVE-2012-5885: The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation
in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client
nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for
remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a
different vulnerability than CVE-2011-1184. This has been classified by the vendor as having a CVSSv2 score of
5.0 (AV:N/AC:L/AU:N/C:P/I:N/A:N)

CVE-2012-5886: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x
before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state,
which makes it easier for remote attackers to bypass authentication via vectors related to the session
ID. This has been classified by the vendor as having a CVSSv2 score of 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)

CVE-2012-5887: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x
before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with
enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access
restrictions by sniffing the network for valid requests. This has been classified by the vendor as having a
CVSSv2 score of 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)

CVE-2013-2067: java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication
feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the
relationships between authentication requirements and sessions, which allows remote attackers to inject a
request into a session by sending this request during completion of the login form, a variant of a session
fixation attack. This has been classified by the vendor as having a CVSSv2 score of 6.8
(AV:N/AC:M/AU:N/C:P/I:P/A:P)

CVE-2013-2071: java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not
properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows
context-dependent attackers to obtain sensitive request information intended for other applications in
opportunistic circumstances via an application that records the requests that it processes. This has been
classified by the vendor as having a CVSSv2 score of 2.6 (AV:N/AC:H/AU:N/C:P/I:N/A:N)

This bug was opened to address the potential impact on this product.

Conditions:
Running a version of Call Manager prior to this bugfix.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.