CVE-2011-1184

Severity

9.1

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Apache Tomcat 7.0.x

First release:

2011-01-14

First release:

2021-03-31

Support Lifecycle:

Maintenance Support

Namespace:

javax

7.0.6 7.0.8 7.0.11

Apache Tomcat 6.0.x

First release:

2007-02-28

First release:

2016-12-31

Support Lifecycle:

Unsupported

Namespace:

javax

6.0.13 6.0.14 6.0.16

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.

CVE-2011-1184

Severity

9.1

Description

Mitigation

Related links:

Project

Category

Tags

Date Disclosed

Date Discovered

Apache Tomcat 7.0.x

Apache Tomcat 6.0.x

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.

Tomitribe

Services

Open Source