CVE-2016-0762: Observable Discrepancy in Apache Tomcat
Summary
CVE-2016-0762: Observable Discrepancy in Apache Tomcat. Affects org.apache.tomcat:tomcat across 5 version ranges.
>= 6.0.0, < 6.0.46
>= 7.0.0, < 7.0.72
>= 8.0.0.RC1, < 8.0.37
>= 8.5.0, < 8.5.5
>= 9.0.0M1, < 9.0.0.M10
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability in Apache Tomcat versions 6.0.0 to 9.0.0.M9 allows for a timing attack to determine valid user names. This vulnerability arises from a discrepancy in the Realm implementations, specifically in the processing of supplied passwords when the supplied user name does not exist. The default configuration includes the LockOutRealm, which makes exploiting this vulnerability more difficult.
Vulnerability Detail
The vulnerability in Apache Tomcat allows for a timing attack to determine valid user names. When a user name does not exist, the Realm implementations do not process the supplied password. This discrepancy can be exploited through a timing attack, where an attacker can measure the time it takes for a response to determine if a user name is valid or not. By repeatedly attempting different user names and measuring the response times, an attacker can gradually narrow down the list of valid user names. This vulnerability has a CVSS score of 5.9, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.466.0.46 -
>= 7.0.0, < 7.0.727.0.72 -
>= 8.0.0.RC1, < 8.0.378.0.37 -
>= 8.5.0, < 8.5.58.5.5 -
>= 9.0.0M1, < 9.0.0.M109.0.0.M10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to disable the LockOutRealm in the Tomcat configuration. This can be done by modifying the server.xml file and removing or commenting out the LockOutRealm configuration. However, it is important to note that this workaround may reduce the security of the system, as it removes an additional layer of protection against brute-force attacks.
Conclusion
The vulnerability in Apache Tomcat allows for a timing attack to determine valid user names. It is important to upgrade to a fixed version of Apache Tomcat to mitigate this vulnerability. If immediate upgrading is not possible, disabling the LockOutRealm can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container used for deploying Java-based web applications.
This vulnerability allows for a timing attack to determine valid user names, potentially aiding in unauthorized access to the system.
A timing attack is a type of side-channel attack where an attacker measures the time it takes for a response to gain information about a system.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
