CVE-2013-2051 - tomcat: DIGEST authentication vulnerable to replay attacks

Back Back to CVE browser

LOW

tomcat: DIGEST authentication vulnerable to replay attacks

Published Jul 9, 2013

2.6

LOW

CVSS 2.0

EPSS 2.13%

Description

The Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows remote attackers to bypass intended access restrictions by performing a replay attack after a nonce becomes stale. NOTE: this issue is due to an incomplete fix for CVE-2012-5887.

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	tomcat6-0:6.0.24-55.el6_4	Fixed	RHSA-2013:0869

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (7)

http://rhn.redhat.com/errata/RHSA-2013-0869.html
vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.securityfocus.com/bid/60187
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-2051
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=959047
x_refsource_CONFIRMVendor AdvisoryIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2033
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2013-2051
https://www.cve.org/CVERecord?id=CVE-2013-2051

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2013-0869.html		vendor-advisoryx_refsource_REDHATVendor Advisory
http://www.securityfocus.com/bid/60187		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-2051		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=959047		x_refsource_CONFIRMVendor AdvisoryIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2033		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2013-2051
https://www.cve.org/CVERecord?id=CVE-2013-2051