Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2012-5885 | First vendor Publication | 2012-11-17 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5885 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:19322 | |||
| Oval ID: | oval:org.mitre.oval:def:19322 | ||
| Title: | HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities | ||
| Description: | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2012-5885 | Version: | 12 |
| Platform(s): | HP-UX 11 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:19432 | |||
| Oval ID: | oval:org.mitre.oval:def:19432 | ||
| Title: | HP-UX Running Apache, Remote Denial of Service (DoS), Execution of Arbitrary Code and other vulnerabilities | ||
| Description: | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2012-5885 | Version: | 11 |
| Platform(s): | HP-UX 11 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-11-27 | Name : Apache Tomcat Multiple Security Bypass Vulnerabilities (Windows) File : nvt/gb_apache_tomcat_mult_sec_bypass_vuln_win.nasl |
| 2012-11-23 | Name : Ubuntu Update for tomcat6 USN-1637-1 File : nvt/gb_ubuntu_USN_1637_1.nasl |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2013-11-21 | IAVM : 2013-A-0219 - Multiple Vulnerabilities in Juniper Networks and Security Manager Severity : Category I - VMSKEY : V0042384 |
| 2013-05-09 | IAVM : 2013-B-0046 - Multiple Vulnerabilities in VMware vCenter Server Appliance 5.1 Severity : Category II - VMSKEY : V0037775 |
| 2013-05-02 | IAVM : 2013-B-0041 - Multiple Vulnerabilities in VMware vCenter Server 5.1 Severity : Category I - VMSKEY : V0037766 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_tomcat_20140401.nasl - Type : ACT_GATHER_INFO |
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-29.nasl - Type : ACT_GATHER_INFO |
| 2014-06-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0266.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-884.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-883.nasl - Type : ACT_GATHER_INFO |
| 2013-11-21 | Name : The remote host is affected by multiple vulnerabilities. File : juniper_nsm_2012_2_r5.nasl - Type : ACT_GATHER_INFO |
| 2013-07-19 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2725.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0623.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0640.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0869.nasl - Type : ACT_GATHER_INFO |
| 2013-07-03 | Name : The remote host has a virtualization appliance installed that is affected by ... File : vmware_vcenter_server_appliance_vmsa-2013-0006.nasl - Type : ACT_GATHER_INFO |
| 2013-05-30 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0869.nasl - Type : ACT_GATHER_INFO |
| 2013-05-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0869.nasl - Type : ACT_GATHER_INFO |
| 2013-04-30 | Name : The remote host has a virtualization management application installed that is... File : vmware_vcenter_vmsa-2013-0006.nasl - Type : ACT_GATHER_INFO |
| 2013-03-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0647.nasl - Type : ACT_GATHER_INFO |
| 2013-03-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0640.nasl - Type : ACT_GATHER_INFO |
| 2013-03-13 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130312_tomcat5_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2013-03-13 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130311_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2013-03-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0640.nasl - Type : ACT_GATHER_INFO |
| 2013-03-13 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0623.nasl - Type : ACT_GATHER_INFO |
| 2013-03-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0629.nasl - Type : ACT_GATHER_INFO |
| 2013-03-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0623.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_tomcat6-130107.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_tomcat5-8397.nasl - Type : ACT_GATHER_INFO |
| 2012-12-20 | Name : The remote Fedora host is missing a security update. File : fedora_2012-20151.nasl - Type : ACT_GATHER_INFO |
| 2012-11-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1637-1.nasl - Type : ACT_GATHER_INFO |
| 2012-11-21 | Name : The remote Apache Tomcat server is affected by multiple security weaknesses. File : tomcat_5_5_36.nasl - Type : ACT_GATHER_INFO |
| 2012-11-21 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_36.nasl - Type : ACT_GATHER_INFO |
| 2012-11-21 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_7_0_30.nasl - Type : ACT_GATHER_INFO |
| 2012-11-12 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_152e4c7e2a2e11e299c700a0d181e71d.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 22:59:03 |
|
| 2024-11-28 12:32:33 |
|
| 2021-05-04 12:22:40 |
|
| 2021-04-22 01:27:03 |
|
| 2020-05-23 00:35:23 |
|
| 2017-09-19 09:25:38 |
|
| 2017-08-29 09:24:10 |
|
| 2016-08-23 09:24:47 |
|
| 2016-04-26 22:32:26 |
|
| 2015-01-21 13:25:55 |
|
| 2014-12-16 13:24:56 |
|
| 2014-06-27 13:26:11 |
|
| 2014-06-14 13:34:05 |
|
| 2014-02-17 11:14:39 |
|
| 2013-12-05 17:19:22 |
|
| 2013-11-25 17:21:14 |
|
| 2013-08-20 17:22:38 |
|
| 2013-06-05 13:19:47 |
|
| 2013-05-16 17:02:55 |
|
| 2013-05-10 22:50:06 |
|
| 2013-03-23 13:18:29 |
|
| 2013-03-07 13:19:56 |
|
| 2013-02-14 13:25:08 |
|
| 2013-02-08 13:20:14 |
|
| 2013-02-02 13:23:35 |
|
| 2012-12-21 13:20:39 |
|
| 2012-11-19 17:21:52 |
|
| 2012-11-18 00:21:06 |
|
