Apache Tomcat Authentication Header Realm Name信息泄露漏洞

<a href="https://www.exploit-db.com/exploits/12343" target="_blank">https://www.exploit-db.com/exploits/12343</a><br/> <a href="https://www.securityfocus.com/bid/39635" target="_blank">https://www.securityfocus.com/bid/39635</a><br/> <a href="https://cxsecurity.com/issue/WLB-2010040290" target="_blank">https://cxsecurity.com/issue/WLB-2010040290</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201004-393" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201004-393</a><br/>

ApacheTomcat是一款由ApacheFoundation维护的免费开放源代码的Web服务器程序。BASIC和DIGEST认证的WWW-Authenticate头包含有区域名。如果web.xml中对应用指定了元素，就会使用指定的区域名，否则Tomcat就会使用以下代码段生成一个区域名：request.getServerName()+":"+request.getServerPort()在某些环境中这可能会暴露运行Tomcat机器的本地主机名或IP地址。

来源:BUGTRAQ
名称:20100421[SECURITY]CVE-2010-1157:ApacheTomcatinformationdisclosurevulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/510879/100/0/threaded
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-6.html
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-5.html