CVE-2009-3548 - Credentials Management vulnerability in Apache Tomcat

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Tomcat 5.5.27 Apache Tomcat 3.1 Apache Tomcat 4.1.2 Apache Tomcat 4.0.4 Apache Tomcat 4.1.35 Apache Tomcat 4.1.36 Apache Tomcat 3.2.1 Apache Tomcat 4.1.9 Apache Tomcat 5.5.18 Apache Tomcat 5.0.8 Apache Tomcat 5.0.19 Apache Tomcat 4.1.21 Apache Tomcat 6.0.6 Apache Tomcat 6.0.11 Apache Tomcat 5.5.12 Apache Tomcat 5.0.14 Apache Tomcat 5.5.14 Apache Tomcat 4.1.24 Apache Tomcat 3.2.2 Apache Tomcat 5.5.10 Apache Tomcat 5.0.22 Apache Tomcat 5.5.4 Apache Tomcat 5.5.7 Apache Tomcat 5.5.1 Apache Tomcat 5.0.7 Apache Tomcat 6.0.7 Apache Tomcat 5.5.11 Apache Tomcat 4.1.25 Apache Tomcat 5.5.28 Apache Tomcat 6.0.4 Apache Tomcat 5.5.6 Apache Tomcat 5.5.26 Apache Tomcat 4.1.39 Apache Tomcat 5.0.9 Apache Tomcat 4.1.4 Apache Tomcat 5.0.15 Apache Tomcat 3.3.2 Apache Tomcat 5.0.30 Apache Tomcat 5.5.20 Apache Tomcat 5.5.15 Apache Tomcat 5.0.23 Apache Tomcat 3.2.4 Apache Tomcat 5.0.2 Apache Tomcat 5.5.5 Apache Tomcat 5.0.10 Apache Tomcat 4.1.27 Apache Tomcat 6.0.15 Apache Tomcat 4.1.30 Apache Tomcat 4.1.7 Apache Tomcat 4.1.38 Apache Tomcat 4.1.11 Apache Tomcat 5.0.21 Apache Tomcat 3.0 Apache Tomcat 5.0.26 Apache Tomcat 5.5.21 Apache Tomcat 4.1.18 Apache Tomcat 5.5.22 Apache Tomcat 6.0.20 Apache Tomcat 4.1.14 Apache Tomcat 6.0.10 Apache Tomcat 6.0.3 Apache Tomcat 4.1.19 Apache Tomcat 5.0.0 Apache Tomcat 5.0.6 Apache Tomcat 6.0.9 Apache Tomcat 4.1.31 Apache Tomcat 5.5.3 Apache Tomcat 5.0.27 Apache Tomcat 4.1.16 Apache Tomcat 4.1.29 Apache Tomcat 5.0.16 Apache Tomcat 6.0.17 Apache Tomcat 4.1.22 Apache Tomcat 4.0.6 Apache Tomcat 6.0 Apache Tomcat 4.1.5 Apache Tomcat 4.1.26 Apache Tomcat 4.1.13 Apache Tomcat 4.1.8 Apache Tomcat 5.5.9 Apache Tomcat 4.0.3 Apache Tomcat 5.5.25 Apache Tomcat 5.0.18 Apache Tomcat 6.0.0 Apache Tomcat 4.1.17 Apache Tomcat 4.0.1 Apache Tomcat 3.3.1A Apache Tomcat 6.0.14 Apache Tomcat 5.5.2 Apache Tomcat 5.0.5 Apache Tomcat 5.0.28 Apache Tomcat 5.0.29 Apache Tomcat 4.1.33 Apache Tomcat 5.5.0 Apache Tomcat 4.1.1 Apache Tomcat 5.5.13 Apache Tomcat 6.0.1 Apache Tomcat 6.0.12 Apache Tomcat 5.5.24 Apache Tomcat 4.1.12 Apache Tomcat 4.1.28 Apache Tomcat 5.0.13 Apache Tomcat 6.0.18 Apache Tomcat 4.1.15 Apache Tomcat 4.1.3 Apache Tomcat 4.1.10 Apache Tomcat 5.5.8 Apache Tomcat 5.0.17 Apache Tomcat 5.5.16 Apache Tomcat 4.1.0 Apache Tomcat 6.0.5 Apache Tomcat 4.1.20 Apache Tomcat 3.1.1 Apache Tomcat 4.0.2 Apache Tomcat 5.5.17 Apache Tomcat 5.5.19 Apache Tomcat 4.0.5 Apache Tomcat 4.1.23 Apache Tomcat 4.0.0 Apache Tomcat 4.1.34 Apache Tomcat 5.0.4 Apache Tomcat 4.1.32 Apache Tomcat 3.2.3 Apache Tomcat 4.1.37 Apache Tomcat 6.0.2 Apache Tomcat 5.0.25 Apache Tomcat 6.0.13 Apache Tomcat 5.0.1 Apache Tomcat 3.2 Apache Tomcat 3.3.1 Apache Tomcat 5.0.11 Apache Tomcat 5.5.23 Apache Tomcat 4.1.6 Apache Tomcat 5.0.3 Apache Tomcat 5.0.24 Apache Tomcat 6.0.16 Apache Tomcat 3.3 Apache Tomcat 6.0.8 Apache Tomcat 5.0.12	142

Common Weakness Enumeration (CWE)

CWE-255 - Credentials Management

Exploit-Db

description	Apache Tomcat Manager - Application Upload Authenticated Code Execution. CVE-2009-3548. Remote exploits for multiple platform
id	EDB-ID:31433
last seen	2016-02-03
modified	2014-02-05
published	2014-02-05
reporter	metasploit
source	https://www.exploit-db.com/download/31433/
title	Apache Tomcat Manager - Application Upload Authenticated Code Execution

description	Apache Tomcat Manager Application Deployer Authenticated Code Execution. CVE-2009-3548,CVE-2009-3843,CVE-2009-4188,CVE-2009-4189,CVE-2010-0557,CVE-2010-4094....
id	EDB-ID:16317
last seen	2016-02-01
modified	2010-12-14
published	2010-12-14
reporter	metasploit
source	https://www.exploit-db.com/download/16317/
title	Apache Tomcat Manager Application Deployer Authenticated Code Execution

Metasploit

description	This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.
id	MSF:EXPLOIT/MULTI/HTTP/TOMCAT_MGR_UPLOAD
last seen	2020-06-10
modified	2018-08-20
published	2014-01-27
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3843 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4189 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4188 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0557 http://www-01.ibm.com/support/docview.wss?uid=swg21419179 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4094 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3548 http://tomcat.apache.org/tomcat-5.5-doc/manager-howto.html
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/tomcat_mgr_upload.rb
title	Apache Tomcat Manager Authenticated Upload Code Execution

description	This module simply attempts to login to a Tomcat Application Manager instance using a specific user/pass.
id	MSF:AUXILIARY/SCANNER/HTTP/TOMCAT_MGR_LOGIN
last seen	2019-11-17
modified	2019-06-27
published	2013-05-29
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3843 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4189 http://www.harmonysecurity.com/blog/2009/11/hp-operations-manager-backdoor-account.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4188 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0557 http://www-01.ibm.com/support/docview.wss?uid=swg21419179 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4094 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3548 http://tomcat.apache.org/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0502
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/http/tomcat_mgr_login.rb
title	Tomcat Application Manager Login Utility

description	This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.
id	MSF:EXPLOIT/MULTI/HTTP/TOMCAT_MGR_DEPLOY
last seen	2020-05-21
modified	2018-08-20
published	2013-01-07
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3843 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4189 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4188 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0557 http://www-01.ibm.com/support/docview.wss?uid=swg21419179 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4094 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3548 http://tomcat.apache.org/tomcat-5.5-doc/manager-howto.html
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/tomcat_mgr_deploy.rb
title	Apache Tomcat Manager Application Deployer Authenticated Code Execution

Nessus

NASL family	VMware ESX Local Security Checks
NASL id	VMWARE_VMSA-2011-0003.NASL
description	a. vCenter Server and vCenter Update Manager update Microsoft SQL Server 2005 Express Edition to Service Pack 3 Microsoft SQL Server 2005 Express Edition (SQL Express) distributed with vCenter Server 4.1 Update 1 and vCenter Update Manager 4.1 Update 1 is upgraded from SQL Express Service Pack 2 to SQL Express Service Pack 3, to address multiple security issues that exist in the earlier releases of Microsoft SQL Express. Customers using other database solutions need not update for these issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086, CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL Express Service Pack 3. b. vCenter Apache Tomcat Management Application Credential Disclosure The Apache Tomcat Manager application configuration file contains logon credentials that can be read by unprivileged local users. The issue is resolved by removing the Manager application in vCenter 4.1 Update 1. If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon credentials are not present in the configuration file after the update. VMware would like to thank Claudio Criscione of Secure Networking for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2010-2928 to this issue. c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version 1.6.0_21 Oracle (Sun) JRE update to version 1.6.0_21, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0850. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following name to the security issue fixed in Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886. d. vCenter Update Manager Oracle (Sun) JRE is updated to version 1.5.0_26 Oracle (Sun) JRE update to version 1.5.0_26, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566, CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573, CVE-2010-3565,CVE-2010-3568, CVE-2010-3569, CVE-2009-3555, CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562, CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572, CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541, CVE-2010-3574. e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28 Apache Tomcat updated to version 6.0.28, which addresses multiple security issues that existed in earlier releases of Apache Tomcat The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i and CVE-2009-3548. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157. f. vCenter Server third-party component OpenSSL updated to version 0.9.8n The version of the OpenSSL library in vCenter Server is updated to 0.9.8n. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0740 and CVE-2010-0433 to the issues addressed in this version of OpenSSL. g. ESX third-party component OpenSSL updated to version 0.9.8p The version of the ESX OpenSSL library is updated to 0.9.8p. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3864 and CVE-2010-2939 to the issues addressed in this update. h. ESXi third-party component cURL updated The version of cURL library in ESXi is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to the issues addressed in this update. i. ESX third-party component pam_krb5 updated The version of pam_krb5 library is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-3825 and CVE-2009-1384 to the issues addressed in the update. j. ESX third-party update for Service Console kernel The Service Console kernel is updated to include kernel version 2.6.18-194.11.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070, CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524, CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086, CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437, CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and CVE-2010-3081 to the issues addressed in the update. Notes : - The update also addresses the 64-bit compatibility mode stack pointer underflow issue identified by CVE-2010-3081. This issue was patched in an ESX 4.1 patch prior to the release of ESX 4.1 Update 1 and in a previous ESX 4.0 patch release. - The update also addresses CVE-2010-2240 for ESX 4.0.
last seen	2020-06-01
modified	2020-06-02
plugin id	51971
published	2011-02-14
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51971
title	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

NASL family	Misc.
NASL id	VMWARE_VMSA-2011-0003_REMOTE.NASL
description	The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Apache Tomcat - Apache Tomcat Manager - cURL - Java Runtime Environment (JRE) - Kernel - Microsoft SQL Express - OpenSSL - pam_krb5
last seen	2020-06-01
modified	2020-06-02
plugin id	89674
published	2016-03-04
reporter	This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/89674
title	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)

NASL family	Web Servers
NASL id	TOMCAT_MANAGER_COMMON_CREDS.NASL
description	Nessus was able to gain access to the Manager web application for the remote Tomcat server using a known set of credentials. A remote attacker can exploit this issue to install a malicious application on the affected server and run arbitrary code with Tomcat
last seen	2020-06-01
modified	2020-06-02
plugin id	34970
published	2008-11-26
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34970
title	Apache Tomcat Manager Common Administrative Credentials

Oval

accepted

2015-04-20T04:01:15.415-04:00

class

vulnerability

contributors

name Ganesh Manal
organization Hewlett-Packard
name Sushant Kumar Singh
organization Hewlett-Packard
name Prashant Kumar
organization Hewlett-Packard
name Mike Cokus
organization The MITRE Corporation

description

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

family

unix

id

oval:org.mitre.oval:def:19414

status

accepted

submitted

2013-11-22T11:43:28.000-05:00

title

HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Access Restriction Bypass, Unauthorized Modification and Other Vulnerabilities

version

48

accepted

2015-04-20T04:02:32.987-04:00