CVE-2012-5887
The MITRE CVE dictionary describes this issue as:
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Find out more about CVE-2012-5887 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 5 |
|---|---|
| Base Metrics | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server (jbossweb) | RHSA-2013:0629 | 2013-03-11 |
| Red Hat Enterprise Linux 6 (tomcat6) | RHSA-2013:0623 | 2013-03-11 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server (jbossweb) | RHSA-2013:0631 | 2013-03-11 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (jbossweb) | RHSA-2013:0647 | 2013-03-14 |
| Red Hat Enterprise Linux 5 (tomcat5) | RHSA-2013:0640 | 2013-03-12 |
| Red Hat JBoss SOA Platform 5.3 | RHSA-2013:0726 | 2013-04-09 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server (jbossweb) | RHSA-2013:0647 | 2013-03-14 |
| Red Hat JBoss Web Platform 5.2 | RHSA-2013:0633 | 2013-03-11 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server (tomcat6) | RHSA-2013:0266 | 2013-02-19 |
| Red Hat JBoss Web Platform 5 for RHEL 4 AS (jbossweb) | RHSA-2013:0631 | 2013-03-11 |
| JBoss Data Grid 6.1 | RHSA-2013:0665 | 2013-03-20 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS (jbossweb) | RHSA-2013:0629 | 2013-03-11 |
| JBoss Enterprise BRMS Platform 5.3 | RHSA-2013:1006 | 2013-07-01 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server (jbossweb) | RHSA-2013:0631 | 2013-03-11 |
| Red Hat JBoss Web Server 2.0 | RHSA-2013:0265 | 2013-02-19 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server (jbossweb) | RHSA-2013:0629 | 2013-03-11 |
| Red Hat JBoss Enterprise Application Platform 5.2 | RHSA-2013:0632 | 2013-03-11 |
| Red Hat JBoss Enterprise Application Platform 6.0 | RHSA-2013:0648 | 2013-03-14 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server (tomcat6) | RHSA-2013:0266 | 2013-02-19 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Portal 5 | jbossweb | Will not fix |
| Red Hat JBoss Operations Network 3.1 | jbossweb | Not affected |
CVE description copyright © 2017, The MITRE Corporation