Apache Tomcat Security Vulnerabilities (5.x ~ 7. x)

CVE-2011-2204Apache Tomcat Information Leakage

Security level: low

Affected Versions:
-Tomcat 7.0.0 to 7.0.16
-Tomcat 6.0.0 to 6.0.32
-Tomcat 5.5.0 to 5.5.33

Earlier versions may also be affected.

Vulnerability description:

When you use MemoryUserDatabase (tomcat-users.xml-based) and create a user through JMX, if an exception occurs, the error message on the JMX client will contain the user's password, this error message is also written to the Tomcat log file.

Steps to reproduce this vulnerability:

The Tomcat security team had to modify the Tomcat source code so that it could not reproduce the problem. In theory, an OutOfMemoryError will directly cause this vulnerability.

Solution:

-Do not use JMX to manage MemoryUserDatabase
-Use the digest Password
-Restrict Tomcat Log File Access
-Upgrade Tomcat to 7.0.17, 6.0.33 or 5.5.34 or later.
-Patch:
-7.0.x: http://svn.apache.org/viewvc? Rev. = 1140070 & view = rev
-6.0.x: http://svn.apache.org/viewvc? Rev. = 1140071 & view = rev
-5.5.x: http://svn.apache.org/viewvc? Rev. = 1140072 & view = rev