78331 : Apache Tomcat Request Object Recycling Information Disclosure
Printer | http://osvdb.org/78331 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
45	2647	over 1 year ago	5 days ago	5 times	100%

Timeline

Disclosure Date
2012-01-17

Description

Apache Tomcat contains a flaw that may lead to unauthorized disclosure of potentially sensitive information. The issue is due to the application not properly recycling requested objects before processing the next request when logging various actions and may disclose the remote IP address and HTTP headers to a remote attacker.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Solution: Upgrade, Third-Party Solution
Exploit: Exploit Unknown
Disclosure: Vendor Verified, Third-party Verified

Solution

It has been reported that this issue has been fixed. Upgrade to version 6.0.35, 7.0.22, or higher, to address this vulnerability.

Products

The Apache Software Foundation	Apache Tomcat	6.0.30
		6.0.33
		7.0.0
		7.0.21
	Bigtop	0.4.0

References

CVE ID: 2011-3375 (see also: NVD)
Secunia Advisory ID: 47554 47794 47996 48444 49270 49702 50745 52740
Vendor Specific News/Changelog Entry: http://mail-archives.apache.org/mod_mbox/tomcat-announce/201201.mbox/%3C4F155CDC.8050804%40apache.org%3E
http://security.gentoo.org/glsa/glsa-201206-24.xml
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://www.debian.org/security/2012/dsa-2401
http://www.ibm.com/support/docview.wss?uid=ssg1S1004302
http://www.ubuntu.com/usn/usn-1359-1
https://issues.apache.org/bugzilla/show_bug.cgi?id=51872
https://issues.apache.org/jira/browse/BIGTOP-812
Vendor URL: http://tomcat.apache.org/
Vendor Specific Advisory URL: http://www.vmware.com/security/advisories/VMSA-2012-0005.html
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_oracle_java
RedHat RHSA: RHSA-2012:0679 RHSA-2012:0680 RHSA-2012:0681 RHSA-2012:0682

Credit

Apache Tomcat Security Team - Apache Tomcat Security Team

CVSSv2 Score

CVSSv2 Base Score = 5.0
Source: nvd.nist.gov | Generated: 2012-01-19 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.