Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability

Bugtraq ID:	56812
Class:	Design Error
CVE:	CVE-2012-3546
Remote:	Yes
Local:	No
Published:	Dec 04 2012 12:00AM
Updated:	May 23 2017 04:26PM
Credit:	Tomcat security team
Vulnerable:	Xerox FreeFlow Print Server (FFPS) 93.E0.21C Xerox FreeFlow Print Server (FFPS) 90.D3.06 Xerox FreeFlow Print Server (FFPS) 82.D2.24 Xerox FreeFlow Print Server (FFPS) 82.D1.44 Xerox FreeFlow Print Server (FFPS) 82.C5.24 Xerox FreeFlow Print Server (FFPS) 81.D0.73 Xerox FreeFlow Print Server (FFPS) 81.C3.31 Xerox FreeFlow Print Server (FFPS) 73.D4.31B Xerox FreeFlow Print Server (FFPS) 73.D4.31 Xerox FreeFlow Print Server (FFPS) 73.D2.33 VMWare vCenter Server 5.1 Redhat JBoss Enterprise Web Server for RHEL 6 1.0 Redhat JBoss Enterprise Web Server for RHEL 5 Server 1.0 Redhat JBoss Enterprise Web Platform for RHEL 5 Server 5 Redhat JBoss Enterprise Web Platform for RHEL 4ES 5 Redhat JBoss Enterprise Web Platform for RHEL 4AS 5 Redhat JBoss Enterprise BRMS Platform 5.3 Redhat JBoss Enterprise BRMS Platform 5.2 Redhat JBoss Enterprise BRMS Platform 5.1 Redhat JBoss Enterprise Application Platform for RHEL 5 Server 5 Redhat JBoss Enterprise Application Platform for RHEL 4ES 5 Redhat JBoss Enterprise Application Platform for RHEL 4AS 5 Redhat JBoss Enterprise Application Platform 4.3 EL5 Redhat JBoss Enterprise Application Platform 4.3 EL4 Redhat JBoss Enterprise Application Platform 4.3 Redhat JBoss Enterprise Application Platform 6 EL6 Redhat JBoss Enterprise Application Platform 6 EL5 Redhat JBoss Enterprise Application Platform 4.3.0.CP10 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 HP XP P9000 Performance Advisor 5.4.1 HP Network Node Manager i SPI 9.11 HP Network Node Manager i SPI 9.10 HP Network Node Manager i SPI 9.0 HP Network Node Manager i 9.11 HP Network Node Manager i 9.0 HP HP-UX B.11.31 Gentoo Linux CTERA Networks CTERA Portal 3.1 CentOS CentOS 6 CentOS CentOS 5 Avaya Voice Portal 5.1.3 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Secure Access Link Gateway 2.1 Avaya one-X Client Enablement Service 6.1 SP2 Avaya one-X Client Enablement Service 6.1 Sp1 Avaya one-X Client Enablement Service 6.1 Avaya one-X Client Enablement Service 6.0 SP3 Avaya one-X Client Enablement Service 6.0 SP2 Avaya one-X Client Enablement Service 6.0 SP1 Avaya Messaging Application Server 5.2.1 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya IQ 4.1 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya IQ 4.2 Avaya IQ 4.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Server Edition 8.0 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya IP Office Application Server 7.0 Avaya IP Office Application Server 6.1 Avaya IP Office Application Server 6.0 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura System Platform 6.2.1 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.2 SP1 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Manager 6.2.3 Avaya Aura System Manager 6.2 SP3 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.5 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura SIP Enablement Services 5.2.1 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 5.2 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 4.0 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 3.0 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 Avaya Aura Presence Services 6.1.2 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Messaging 6.1.1 Avaya Aura Messaging 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Conferencing 7.0 Avaya Aura Conferencing 6.0 SP1 Standard Avaya Aura Application Server 5300 SIP Core 3.0 PB3 Avaya Aura Application Server 5300 SIP Core 3.0 Avaya Aura Application Server 5300 SIP Core 2.1 Avaya Aura Application Server 5300 SIP Core 2.0 PB28 Avaya Aura Application Server 5300 SIP Core 2.0 PB26 Avaya Aura Application Server 5300 SIP Core 2.0 PB25 Avaya Aura Application Server 5300 SIP Core 2.0 PB16 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 6.2 Avaya Aura Application Enablement Services 6.1.2 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Apache Tomcat 7.0.29 Apache Tomcat 7.0.28 Apache Tomcat 7.0.27 Apache Tomcat 7.0.26 Apache Tomcat 7.0.25 Apache Tomcat 7.0.24 Apache Tomcat 7.0.23 Apache Tomcat 7.0.16 Apache Tomcat 7.0.14 Apache Tomcat 7.0.13 Apache Tomcat 7.0.12 Apache Tomcat 7.0.2 Apache Tomcat 7.0.1 Apache Tomcat 7.0 beta Apache Tomcat 7.0 Apache Tomcat 6.0.35 Apache Tomcat 6.0.32 Apache Tomcat 6.0.28 Apache Tomcat 6.0.27 Apache Tomcat 6.0.26 Apache Tomcat 6.0.25 Apache Tomcat 6.0.24 Apache Tomcat 6.0.20 Apache Tomcat 6.0.18 Apache Tomcat 6.0.17 Apache Tomcat 6.0.16 Apache Tomcat 6.0.15 Apache Tomcat 6.0.14 Apache Tomcat 6.0.13 Apache Tomcat 6.0.12 Apache Tomcat 6.0.11 Apache Tomcat 6.0.10 Apache Tomcat 6.0.3 Apache Tomcat 6.0.2 Apache Tomcat 6.0.1 Apache Tomcat 6.0 Apache Tomcat 7.0.22 Apache Tomcat 7.0.21 Apache Tomcat 7.0.20 Apache Tomcat 7.0.19 Apache Tomcat 7.0.18 Apache Tomcat 7.0.11 Apache Tomcat 7.0.10 Apache Tomcat 6.0.33 Apache Tomcat 6.0.32 Apache Tomcat 6.0.31 Apache Tomcat 6.0.30 Apache Tomcat 0
Not Vulnerable:	VMWare vCenter Server 5.1 Update 1 Redhat Jboss Enterprise Soa Platform 4.3.0 Cp05 Redhat Jboss Enterprise Soa Platform 4.2.0 Cp05 Redhat JBoss Enterprise BRMS Platform 5.3.1 Redhat JBoss Enterprise Application Platform 6.0.1 EL6 Redhat JBoss Enterprise Application Platform 6.0.1 EL5 HP XP P9000 Performance Advisor 5.5.1 CTERA Networks CTERA Portal 3.2.28 CTERA Networks CTERA Portal 3.1.39 Avaya one-X Client Enablement Service 6.1 SP3 Avaya IP Office Server Edition 9.0 Avaya Aura System Manager 6.3 Avaya Aura Conferencing 7.0 Standard Avaya Aura Application Server 5300 SIP Core 3.0 PB5 Apache Tomcat 7.0.30 Apache Tomcat 6.0.36

Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability

Apache Tomcat is prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions, which may aid in further attacks.

This issue affects Tomcat versions prior to 7.0.30 and 6.0.36.

Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability

References:

• Apache Tomcat 6.x Bypass of security constraints CVE-2012-3546 (Apache)
  
• Apache Tomcat 7.x Bypass of security constraints CVE-2012-3546 (Apache)
  
• Apache Tomcat Homepage (Apache)
  
• Apache Tomcat Security Updates (Apache)
  
• HPSBUX02866 SSRT101139 rev.1 - HP-UX Running Apache, Remote Denial of Service (D (HP)
  
• Multiple Tomcat vulnerabilities in Oracle Health Sciences Clinical Development C (Oracle)
  
• Multiple vulnerabilities in CTERA Portal (SEC Consult Vulnerability Lab)
  
• Xerox Security Bulletin XRX14-004 (Xerox)
  
• Important: JBoss Enterprise BRMS Platform 5.3.1 update (Red Hat)
  
• ASA-2013-172: tomcat5 security update (RHSA-2013-0640) (Avaya)
  
• CVE-2012-3546 Apache Tomcat Bypass of security constraints (Avaya Inc)
  
• HPSBMU02894 rev.1 - HP Network Node Manager I (NNMi) for HP-UX, Linux, Solaris, (HP)
  
• HPSBST02955 rev.1 - HP XP P9000 Performance Advisor Software, 3rd party Software (HP)
  
• Important: jbossweb security update RHSA-2013:0163-1 (Red Hat)
  
• Important: jbossweb security update RHSA-2013:0164-1 (Red Hat)
  
• Important: tomcat6 security update RHSA-2013:0004-2 (Red Hat)
  
• Important: tomcat6 security update RHSA-2013:0005-1 (Red Hat)
  
• JBoss Enterprise SOA Platform 4.2.0.CP05 and 4.3.0.CP05 update (Red Hat)
  
• jbossweb security update (Red Hat)
  
• Security Advisory Important: tomcat5 security update (Red Hat)
  
• VMware security updates for vCenter Server (VMware)