CVE-2010-1157

Published: Apr 23, 2010Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.

Affected (53)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 5.5.0
Apache Tomcat	Version 5.5.10
Apache Tomcat	Version 5.5.11
Apache Tomcat	Version 5.5.12
Apache Tomcat	Version 5.5.13
Apache Tomcat	Version 5.5.14
Apache Tomcat	Version 5.5.15
Apache Tomcat	Version 5.5.16
Apache Tomcat	Version 5.5.17
Apache Tomcat	Version 5.5.18
Apache Tomcat	Version 5.5.19
Apache Tomcat	Version 5.5.1
Apache Tomcat	Version 5.5.20
Apache Tomcat	Version 5.5.21
Apache Tomcat	Version 5.5.22
Apache Tomcat	Version 5.5.23
Apache Tomcat	Version 5.5.24
Apache Tomcat	Version 5.5.25
Apache Tomcat	Version 5.5.26
Apache Tomcat	Version 5.5.27
Apache Tomcat	Version 5.5.28
Apache Tomcat	Version 5.5.29
Apache Tomcat	Version 5.5.2
Apache Tomcat	Version 5.5.3
Apache Tomcat	Version 5.5.4
Apache Tomcat	Version 5.5.5
Apache Tomcat	Version 5.5.6
Apache Tomcat	Version 5.5.7
Apache Tomcat	Version 5.5.8
Apache Tomcat	Version 5.5.9

Configuration B

23 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 6.0.0
Apache Tomcat	Version 6.0.10
Apache Tomcat	Version 6.0.11
Apache Tomcat	Version 6.0.12
Apache Tomcat	Version 6.0.13
Apache Tomcat	Version 6.0.14
Apache Tomcat	Version 6.0.15
Apache Tomcat	Version 6.0.16
Apache Tomcat	Version 6.0.17
Apache Tomcat	Version 6.0.18
Apache Tomcat	Version 6.0.19
Apache Tomcat	Version 6.0.1
Apache Tomcat	Version 6.0.20
Apache Tomcat	Version 6.0.24
Apache Tomcat	Version 6.0.26
Apache Tomcat	Version 6.0.2
Apache Tomcat	Version 6.0.3
Apache Tomcat	Version 6.0.4
Apache Tomcat	Version 6.0.5
Apache Tomcat	Version 6.0.6
Apache Tomcat	Version 6.0.7
Apache Tomcat	Version 6.0.8
Apache Tomcat	Version 6.0.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (64)

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=129070310906557&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133469267822771&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=136485229118404&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/39574

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42368

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43310

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/57126

Source: secalert@redhat.com

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=936540

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?view=revision&revision=936541

Source: secalert@redhat.com

Patch

http://tomcat.apache.org/security-5.html

Source: secalert@redhat.com

PatchVendor Advisory

http://tomcat.apache.org/security-6.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2011/dsa-2207

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0896.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0897.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/510879/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/39635

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: secalert@redhat.com

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/0980

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/3056

Source: secalert@redhat.com

Vendor Advisory

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19492

Source: secalert@redhat.com

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html