Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure

CVE-2010-1157: Apache Tomcat information disclosure vulnerability



Severity: Low



Vendor: The Apache Software Foundation



Versions Affected:



- - Tomcat 6.0.0 to 6.0.26



- - Tomcat 5.5.0 to 5.5.29



Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be

affected.





Description:



The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a

realm name. If a <realm-name> element is specified for the application in

web.xml it will be used. However, a <realm-name> is not specified then

Tomcat will generate one using the code snippet:



request.getServerName() + ":" + request.getServerPort() In some

circumstances this can expose the local hostname or IP address of the

machine running Tomcat.



Example:



GET /application/j_security_check HTTP/1.0





HTTP/1.1 401 Unauthorized



Server: Apache-Coyote/1.1



WWW-Authenticate: Basic realm="tomcat01:8080"



Content-Type: text/html;charset=utf-8



Content-Length: 954



Date: Thu, 31 Dec 2009 12:18:11 GMT



Connection: close





Mitigation:



Administrators of web applications that use BASIC or DIGEST authentication

are recommended to set an appropriate realm name in the web application's

web.xml file.



Alternatively, the following patches may be used to change the default realm

to "Authentication required" (without the quotes):



- - Tomcat 6.0.x: http://svn.apache.org/viewvc?view=rev&rev=936540



- - Tomcat 5.5.x: http://svn.apache.org/viewvc?view=rev&rev=936541



These patches will be included in the next releases of Tomcat 5.5.x and

Tomcat 6.0.x. No release date has been set for the next Tomcat 5.5.x and

Tomcat 6.0.x releases.





Credit:



This issue was discovered by Deniz Cevik.





References:



http://tomcat.apache.org/security.html



http://tomcat.apache.org/security-6.html



http://tomcat.apache.org/security-5.html