National Cyber Awareness System

Vulnerability Summary for CVE-2010-1157

Overview

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (07/13/2010)

For official statement, please refer to: https://www.redhat.com/security/data/cve/CVE-2010-1157.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://tomcat.apache.org/security-6.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-6.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-5.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-5.html

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=936541

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=936541

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=936540

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=936540

External Source: VUPEN

Name: ADV-2010-3056

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3056

External Source: VUPEN

Name: ADV-2010-0980

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/0980

External Source: CONFIRM

Name: http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Hyperlink:http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2011-0003.html

External Source: BID

Name: 39635

Hyperlink:http://www.securityfocus.com/bid/39635

External Source: BUGTRAQ

Name: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded

External Source: BUGTRAQ

Name: 20100421 [SECURITY] CVE-2010-1157: Apache Tomcat information disclosure vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/510879/100/0/threaded

External Source: REDHAT

Name: RHSA-2011:0897

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0897.html

External Source: REDHAT

Name: RHSA-2011:0896

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0896.html

External Source: MANDRIVA

Name: MDVSA-2010:177

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

External Source: MANDRIVA

Name: MDVSA-2010:176

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

External Source: DEBIAN

Name: DSA-2207

Hyperlink:http://www.debian.org/security/2011/dsa-2207

External Source: CONFIRM

Name: http://support.apple.com/kb/HT5002

Hyperlink:http://support.apple.com/kb/HT5002

External Source: SECUNIA

Name: 43310

Type: Advisory

Hyperlink:http://secunia.com/advisories/43310

External Source: SECUNIA

Name: 42368

Type: Advisory

Hyperlink:http://secunia.com/advisories/42368

External Source: SECUNIA

Name: 39574

Type: Advisory

Hyperlink:http://secunia.com/advisories/39574

External Source: HP

Name: SSRT101146

Hyperlink:http://marc.info/?l=bugtraq&m=136485229118404&w=2

External Source: HP

Name: HPSBUX02860

Hyperlink:http://marc.info/?l=bugtraq&m=136485229118404&w=2

External Source: HP

Name: HPSBUX02579

Hyperlink:http://marc.info/?l=bugtraq&m=129070310906557&w=2

External Source: HP

Name: HPSBUX02579

Hyperlink:http://marc.info/?l=bugtraq&m=129070310906557&w=2

External Source: SUSE

Name: SUSE-SR:2010:017

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

External Source: APPLE

Name: APPLE-SA-2011-10-12-3

Hyperlink:http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html