Apache Tomcat DIGEST身份验证多个安全漏洞(CVE-2012-3439)

发布时间: 2012-11-05 (GMT+0800)
漏洞版本:

Apache Group Tomcat 7.x
Apache Group Tomcat 6.x
Apache Group Tomcat 5.x
漏洞描述:

BUGTRAQ ID: 56403
CVE ID: CVE-2012-3439

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。

Apache Tomcat 7.0.0-7.0.27、6.0.0-6.0.35、5.5.0-5.5.35存在多个安全漏洞，成功利用后可允许攻击者绕过安全限制并执行非法操作。
<* 参考 http://secunia.com/advisories/51138/
http://tomcat.apache.org/security-6.html
*>

Description
A weakness and a vulnerability have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).

1) An error within the “parseHeaders()” function (InternalNioInputBuffer.java) when parsing request headers does not properly verify the permitted size and can be exploited to trigger an OutOfMemoryError exception via specially crafted headers.

This vulnerability is reported in versions 6.0.0-6.0.35 and 7.0.0-7.0.27.

2) An error within DIGEST authentication mechanism does not properly check server nonces.

This weakness is reported in versions 5.5.0-5.5.35, 6.0.0-6.0.35, and 7.0.0-7.0.29.

Solution
Update to version 5.5.36, 6.0.36, or 7.0.30.
tomcat下载地址:http://tomcat.apache.org/download-60.cgi

tomcat升级参见 http://blog.c1gstudio.com/archives/1434