Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness

Bugtraq ID:	60187
Class:	Unknown
CVE:	CVE-2013-2051
Remote:	Yes
Local:	No
Published:	May 03 2013 12:00AM
Updated:	May 23 2017 04:26PM
Credit:	Reported by the vendor.
Vulnerable:	Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Optional 6 CentOS CentOS 6 Apache Tomcat 7.0.30 Apache Tomcat 7.0.29 Apache Tomcat 7.0.28 Apache Tomcat 7.0.27 Apache Tomcat 7.0.26 Apache Tomcat 7.0.25 Apache Tomcat 7.0.24 Apache Tomcat 7.0.23 Apache Tomcat 7.0.16 Apache Tomcat 7.0.15 Apache Tomcat 7.0.14 Apache Tomcat 7.0.13 Apache Tomcat 7.0.12 Apache Tomcat 7.0.2 Apache Tomcat 7.0.1 Apache Tomcat 7.0 Apache Tomcat 6.0.36 Apache Tomcat 6.0.35 Apache Tomcat 6.0.29 Apache Tomcat 6.0.28 Apache Tomcat 6.0.27 Apache Tomcat 6.0.26 Apache Tomcat 6.0.25 Apache Tomcat 6.0.24 Apache Tomcat 6.0.20 Apache Tomcat 6.0.18 Apache Tomcat 6.0.17 Apache Tomcat 6.0.16 Apache Tomcat 6.0.15 Apache Tomcat 6.0.14 Apache Tomcat 6.0.13 Apache Tomcat 6.0.12 Apache Tomcat 6.0.11 Apache Tomcat 6.0.10 Apache Tomcat 6.0.3 Apache Tomcat 6.0.2 Apache Tomcat 6.0.1 Apache Tomcat 6.0 Apache Tomcat 5.5.36 Apache Tomcat 5.5.35 Apache Tomcat 5.5.34 Apache Tomcat 5.5.32 Apache Tomcat 5.5.30 Apache Tomcat 5.5.29 Apache Tomcat 5.5.28 Apache Tomcat 5.5.27 Apache Tomcat 5.5.26 Apache Tomcat 5.5.25 Apache Tomcat 5.5.24 Apache Tomcat 5.5.23 Apache Tomcat 5.5.22 Apache Tomcat 5.5.21 Apache Tomcat 5.5.20 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 Apache Tomcat 5.5.19 Apache Tomcat 5.5.18 Apache Tomcat 5.5.17 Apache Tomcat 5.5.16 Apache Tomcat 5.5.15 Apache Tomcat 5.5.14 Apache Tomcat 5.5.13 Apache Tomcat 5.5.12 Apache Tomcat 5.5.11 Apache Tomcat 5.5.10 Apache Tomcat 5.5.3 Apache Tomcat 5.5.2 Apache Tomcat 5.5.1 Apache Tomcat 5.5 Apache Tomcat 7.0.22 Apache Tomcat 7.0.21 Apache Tomcat 7.0.20 Apache Tomcat 7.0.19 Apache Tomcat 7.0.18 Apache Tomcat 7.0.17 Apache Tomcat 7.0.11 Apache Tomcat 7.0.10 Apache Tomcat 6.0.33 Apache Tomcat 6.0.32 Apache Tomcat 6.0.31 Apache Tomcat 6.0.30 Apache Tomcat 5.5.33
Not Vulnerable:

Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness

Apache Tomcat is prone to a security weakness.

Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.

Note: This issue is the result of an incomplete fix for the issue (CVE-2012-5887) described in BID 56403 (Apache Tomcat DIGEST Authentication Multiple Security Weaknesses).

This issue affects the following versions:

Tomcat 7.0.0 through 7.0.30
Tomcat 6.0.0 through 6.0.36
Tomcat 5.5.0 through 5.5.36

Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness

References:

• Apache Tomcat Homepage (Apache)
  
• Bug 959047 - (CVE-2013-2051) CVE-2013-2051 tomcat: DIGEST authentication vulnera (Red Hat Bugzilla)