Multiple weaknesses in HTTP DIGEST authentication
CVE: CVE-2011-1184
Component: tomcat
Severity: Moderate
Release date: 2011-09-26T00:00:00+00:00

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Users of Tomcat should upgrade to these updated packages, which
resolve these issues. Tomcat must be restarted for this update to take
effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains download links (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
For users of JBoss Enterprise BRMS Platform and JBoss Enterprise SOA
Platform, it is recommend to halt the server by stopping the JBoss
Application Server process before installing this update, and then after
installing the update, restart the server by starting the JBoss Application
Server process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Application Platform installation (including all
applications and configuration files).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
Note that if you have created custom applications that are packaged with a
copy of the JBoss Seam 2 library, those applications must be rebuilt with
the updated jboss-seam.jar file provided by this update.
The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for this update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Web Server installation (including all
applications and configuration files).

Tomcat must be restarted for this update to take effect.