CVE-2012-5885

La funcionalidad replay-countermeasure en Apache Tomcat v5.5.x antes de v5.5.36, 6.x antes 6.0.36, v7.x antes de v7.0.30 registra valores cnonce (alias client nonce) en lugar de nonce (alias server nonce) y valores nc (alias nonce-count), lo que hace que sea más fácil para los atacantes remotos evitar las restricciones de acceso esnifando peticiones válidas a través del tráfico de red, una vulnerabilidad diferente a CVE-2011-1184.

Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS 5.3.1. It includes various bug fixes. The following security issues are also fixed with this release: XML encryption backwards compatibility attacks were found against various frameworks, including Apache CXF. An attacker could force a server to use insecure, legacy cryptosystems, even when secure cryptosystems were enabled on endpoints. By forcing the use of legacy cryptosystems, flaws such as CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be recovered from cryptograms and symmetric keys. This issue affected both the JBoss Web Services CXF and JBoss Web Services Native stacks.