Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability

Bugtraq ID:	65769
Class:	Unknown
CVE:	CVE-2014-0033
Remote:	Yes
Local:	No
Published:	Feb 25 2014 12:00AM
Updated:	Jul 05 2016 09:59PM
Credit:	Apache Tomcat Security Team.
Vulnerable:	IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 IBM Scale Out Network Attached Storage 1.3.0.5 IBM Scale Out Network Attached Storage 1.3.0.4 IBM Rational Policy Tester 8.5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Application Server 5300 SIP Core 2.1 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 6.1.1 Apache Software Foundation Tomcat 6.0.35 Apache Software Foundation Tomcat 6.0.33
Not Vulnerable:

Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability

Apache Tomcat is prone to a session-fixation vulnerability.

An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application.

Tomcat versions 6.0.33 through 6.0.37 are vulnerable.

Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability

To exploit these issues an attacker entices an unsuspecting user into following a malicious URI.

Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability

References:

• Apache Tomcat 6.x vulnerabilities (Apache)
  
• Apache Tomcat Homepage (Apache)
  
• Apache Tomcat security vulnerability issues on IBM SONAS (IBM)
  
• Juniper Secure Analytics (JSA)/Security Threat Response Manager (STRM): Multiple (Juniper)
  
• Rational Lifecycle Adapter for HP ALM Apache Tomcat fix (IBM)
  
• Revision 1149220 (Apache Software Foundation)
  
• Revision 1558822 (Apache Software Foundation)
  
• Apache Tomcat and FileUpload Vulnerabilities in IBM UrbanCode Deploy (IBM)
  
• IBM Algo One is affected by multiple Open Source Tomcat security vulnerabilities (IBM)
  
• IBM OpenPages GRC Platform, multiple vulnerabilities in bundled version of Apach (IBM)
  
• IBM Rational Policy Tester can be affected by multiple vulnerabilities in Apache (IBM)
  
• IBM Security AppScan Enterprise can be affected by multiple vulnerabilities in A (IBM)
  
• Multiple vulnerabilities in Apache Tomcat used by IBM QRadar Security Informatio (IBM)
  
• Oracle Critical Patch Update Advisory - July 2014 (Oracle)
  
• RHSA-2014:0525-1 Moderate: Red Hat JBoss Web Server 2.0.1 tomcat6 security updat (Red Hat)
  
• RHSA-2014:0528-1 Moderate: Red Hat JBoss Web Server 2.0.1 tomcat6 security updat (Red Hat)
  
• Security Bulletin: Apache Tomcat and FileUpload Vulnerabilities in IBM UrbanCode (IBM)
  
• Security Bulletin: Apache Tomcat security vulnerability issues on IBM Storwize V (IBM)
  
• Security Bulletin: IBM Rational Connector for SAP Solution Manager (CVE-2013-428 (IBM)
  
• Security Bulletin: Multiple Apache Tomcat vulnerabilities in IBM Algo Audit and (IBM)
  
• Security vulnerabilities in Apache Tomcat for WebSphere Application Server (IBM)
  
• Session fixation still possible with disableURLRewriting enabled (CVE-2014-0033) (Avaya)
  
• The IBM V840 product model number AE1 node is affected by vulnerabilities in Apa (IBM)
  
• Tivoli Application Dependency Discovery Manager - Open Source Tomcat issues (IBM)