NVD Vulnerability Detail

CVE-2010-1157

Summary	Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Publication Date	April 23, 2010, 11:30 p.m.
Registration Date	Jan. 29, 2021, 10:59 a.m.
Last Update	Feb. 13, 2023, 1:17 p.m.

CVSS2.0 : LOW
Score	2.6
Vector	AV:N/AC:H/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:5.5.27:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.28:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:5.5.29:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:6.0.17:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:6.0.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://tomcat.apache.org/security-6.html	CONFIRM	Patch Vendor Advisory
2	http://tomcat.apache.org/security-5.html	CONFIRM	Patch Vendor Advisory
3	http://www.securityfocus.com/bid/39635	BID
4	http://svn.apache.org/viewvc?view=revision&revision=936540	CONFIRM	Patch
5	http://secunia.com/advisories/39574	SECUNIA	Vendor Advisory
6	http://www.vupen.com/english/advisories/2010/0980	VUPEN	Vendor Advisory
7	http://svn.apache.org/viewvc?view=revision&revision=936541	CONFIRM	Patch
8	http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	MANDRIVA
9	http://www.mandriva.com/security/advisories?name=MDVSA-2010:177	MANDRIVA
10	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html	SUSE
11	http://marc.info/?l=bugtraq&m=129070310906557&w=2	HP
12	http://secunia.com/advisories/42368	SECUNIA	Vendor Advisory
13	http://www.vupen.com/english/advisories/2010/3056	VUPEN	Vendor Advisory
14	http://www.vmware.com/security/advisories/VMSA-2011-0003.html	CONFIRM
15	http://secunia.com/advisories/43310	SECUNIA	Vendor Advisory
16	http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html	CONFIRM
17	http://www.redhat.com/support/errata/RHSA-2011-0896.html	REDHAT
18	http://www.redhat.com/support/errata/RHSA-2011-0897.html	REDHAT
19	http://www.debian.org/security/2011/dsa-2207	DEBIAN
20	http://support.apple.com/kb/HT5002	CONFIRM
21	http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html	APPLE
22	http://marc.info/?l=bugtraq&m=136485229118404&w=2	HP
23	http://marc.info/?l=bugtraq&m=139344343412337&w=2	HP
24	http://secunia.com/advisories/57126	SECUNIA
25	http://marc.info/?l=bugtraq&m=133469267822771&w=2	HP
26	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19492	OVAL
27	http://www.securityfocus.com/archive/1/516397/100/0/threaded	BUGTRAQ
28	http://www.securityfocus.com/archive/1/510879/100/0/threaded	BUGTRAQ
29	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	MISC
30	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	MISC
31	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	MISC
32	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	MISC

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Apache Tomcat における BASIC または DIGEST 認証の処理に関する脆弱性

Title	Apache Tomcat における BASIC または DIGEST 認証の処理に関する脆弱性
Summary	Apache Tomcat には、BASIC または DIGEST 認証の処理に関して不備があるため、サーバのホスト名、または IP アドレスを取得される脆弱性が存在します。
Possible impacts	第三者により、サーバのホスト名、または IP アドレスを取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 23, 2010, midnight
Registration Date	May 24, 2010, 6:33 p.m.
Last Update	March 25, 2015, 5:19 p.m.

Affected System

ヒューレット・パッカード

HP XP P9000 Performance Advisor ソフトウェア 5.4.1 およびそれ以前

HP-UX Tomcat-based Servlet Engine 5.5.30.01 未満

Apache Software Foundation

Apache Tomcat 5.5.0 から 5.5.29

Apache Tomcat 6.0.0 から 6.0.26

オラクル

OpenSolaris

Oracle Solaris 10

Oracle Solaris 9

アップル

Apple Mac OS X 10.6.8

Apple Mac OS X Server 10.6.8

日本電気

WebOTX Application Server V8.31

VMware

VMware ESX 3.0.3

VMware ESX 3.5

VMware ESX 4.0

VMware ESX 4.1

VMware vCenter 4.0

VMware vCenter 4.1

VMware VirtualCenter 2.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-1157	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1157
National Vulnerability Database (NVD)
2	CVE-2010-1157	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1157

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apache Software Foundation
1	security-5	http://tomcat.apache.org/security-5.html
2	security-6	http://tomcat.apache.org/security-6.html
Apache-SVN
3	936540	http://svn.apache.org/viewvc?view=revision&revision=936540
4	936541	http://svn.apache.org/viewvc?view=revision&revision=936541
Apple Mailing Lists
5	APPLE-SA-2011-10-12-3 OS X Lion v10.7.2 and Security Update 2011-006	http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Apple Security Updates
6	HT202348	http://support.apple.com/en-us/HT202348
Apple セキュリティアップデート
7	HT202348	http://support.apple.com/ja-jp/HT202348
Hewlett Packard
8	HPUXWSATW313	https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW313
HP Security Bulletin
9	HPSBST02955 SSRT101157	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04047415
10	HPSBUX02579 SSRT100203	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02515878
11	HPSBUX02860 SSRT101146	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c03716627
NEC製品セキュリティ情報
12	NV12-001	http://www.nec.co.jp/security-info/secinfo/nv12-001.html
Red Hat Security Advisory
13	RHSA-2011:0896	https://rhn.redhat.com/errata/RHSA-2011-0896.html
14	RHSA-2011:0897	https://rhn.redhat.com/errata/RHSA-2011-0897.html
SECURITY BLOG
15	Multiple Vulnerabilities in Apache Tomcat	https://blogs.oracle.com/sunsecurity/entry/cve_2009_2902_cve_2009
16	Multiple vulnerabilities in Oracle Java Web Console	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_oracle_java1
VMware
17	VMware vCenter Server 4.1 Update 1 Release Notes	https://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
VMware Security Advisories
18	VMSA-2011-0003	http://www.vmware.com/security/advisories/VMSA-2011-0003.html

その他

No	Name	URL
Secunia Advisory
1	SA39574	http://secunia.com/advisories/39574
SecurityFocus
2	39635	http://www.securityfocus.com/bid/39635
VUPEN Security
3	VUPEN/ADV-2010-0980	http://www.vupen.com/english/advisories/2010/0980

Change Log

No	Changed Details	Date of change
0	[2010年05月24日] 掲載 [2010年10月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Multiple Vulnerabilities in Apache Tomcat) を追加 [2010年12月13日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPUXWSATW313) を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02579 SSRT100203) を追加 [2011年02月28日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：VMware (VMSA-2011-0003) を追加 [2012年02月13日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日本電気 (NV12-001) を追加 [2012年09月28日] ベンダ情報：オラクル (Multiple vulnerabilities in Oracle Java Web Console) を追加 [2015年03月25日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：VMware (VMware vCenter Server 4.1 Update 1 Release Notes) を追加ベンダ情報：アップル (HT202348) を追加ベンダ情報：アップル (APPLE-SA-2011-10-12-3 OS X Lion v10.7.2 and Security Update 2011-006) を追加ベンダ情報：ヒューレット・パッカード (HPSBST02955 SSRT101157) を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02579 SSRT100203) を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02860 SSRT101146) を追加ベンダ情報：レッドハット (RHSA-2011:0896) を追加ベンダ情報：レッドハット (RHSA-2011:0897) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:5.5.27:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.28:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:5.5.29:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:6.0.17:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:6.0.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*