VAR-201005-0325
Vulnerability from variot - Updated: 2025-04-11 23:15com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. SpringSource tc Server is a Tomcat-based web application server released by the vmware subsidiary. com.springsource.tcserver.serviceability.rmi.JmxSocketListener has security issues. If the Listener uses a password-encrypted configuration (such as adding s2enc:// before the password), then you can verify successful access to JMX regardless of whether you enter the correct password or an empty string. interface. By default, the JMX interface does not allow remote access, but it can be configured to be remotely accessible by setting the address property. An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to the JMX interface, which may lead to further attacks. Versions prior to SpringSource tc Server runtime 6.0.20.D and 6.0.25.A-SR01 are vulnerable.
Mitigation: All users are recommended to immediately switch to non-encrypted passwords for the JMX interface or to disable the JMX interface.
References: [1] http://www.springsource.com/security/tc-server
Mark Thomas SpringSource Security Team . ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
http://secunia.com/company/jobs/
TITLE: SpringSource tc Server Encrypted Password Security Bypass
SECUNIA ADVISORY ID: SA39778
VERIFY ADVISORY: http://secunia.com/advisories/39778/
DESCRIPTION: A vulnerability has been reported in SpringSource tc Server, which can be exploited by malicious, local users to bypass certain security restrictions.
The vulnerability is caused due to an error within the com.springsource.tcserver.serviceability.rmi.JmxSocketListener listener when handling encrypted passwords. This can be exploited to bypass the authentication by e.g. entering an empty password.
PROVIDED AND/OR DISCOVERED BY: The vendor credits Erhan Baz, Yapi Kredi.
ORIGINAL ADVISORY: http://www.springsource.com/security/cve-2010-1454
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.19"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20.b"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20.c"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.19.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.25.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.19.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.20.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.20.b"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.20.c"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.25.a"
},
{
"_id": null,
"model": "springsource tc server .a",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.19"
},
{
"_id": null,
"model": "springsource tc server .a",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .a-sr1",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .b",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .c",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .a",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.25"
},
{
"_id": null,
"model": "tc server .a",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.25"
},
{
"_id": null,
"model": "tc server .c",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .b",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .a-sr1",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .a",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .a",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.19"
},
{
"_id": null,
"model": "tc server .a-sr01",
"scope": "ne",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.25"
},
{
"_id": null,
"model": "tc server .d",
"scope": "ne",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:vmware:tc_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
}
]
},
"credits": {
"_id": null,
"data": "Erhan Baz at Yapi Kredi",
"sources": [
{
"db": "BID",
"id": "40205"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
}
],
"trust": 0.9
},
"cve": "CVE-2010-1454",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2010-1454",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2010-1454",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2010-1454",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201005-251",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"description": {
"_id": null,
"data": "com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. SpringSource tc Server is a Tomcat-based web application server released by the vmware subsidiary. com.springsource.tcserver.serviceability.rmi.JmxSocketListener has security issues. If the Listener uses a password-encrypted configuration (such as adding s2enc:// before the password), then you can verify successful access to JMX regardless of whether you enter the correct password or an empty string. interface. By default, the JMX interface does not allow remote access, but it can be configured to be remotely accessible by setting the address property. \nAn attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to the JMX interface, which may lead to further attacks. \nVersions prior to SpringSource tc Server runtime 6.0.20.D and 6.0.25.A-SR01 are vulnerable. \n\nMitigation:\nAll users are recommended to immediately switch to non-encrypted passwords for the JMX interface or to disable the JMX interface. \n\nReferences:\n[1] http://www.springsource.com/security/tc-server\n\nMark Thomas\nSpringSource Security Team\n. ----------------------------------------------------------------------\n\n\nLooking for a job?\n\n\nSecunia is hiring skilled researchers and talented developers. \n\n\nhttp://secunia.com/company/jobs/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nSpringSource tc Server Encrypted Password Security Bypass\n\nSECUNIA ADVISORY ID:\nSA39778\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/39778/\n\nDESCRIPTION:\nA vulnerability has been reported in SpringSource tc Server, which\ncan be exploited by malicious, local users to bypass certain security\nrestrictions. \n\nThe vulnerability is caused due to an error within the\ncom.springsource.tcserver.serviceability.rmi.JmxSocketListener\nlistener when handling encrypted passwords. This can be exploited to\nbypass the authentication by e.g. entering an empty password. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Erhan Baz, Yapi Kredi. \n\nORIGINAL ADVISORY:\nhttp://www.springsource.com/security/cve-2010-1454\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-1454"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "PACKETSTORM",
"id": "89613"
}
],
"trust": 2.61
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2010-1454",
"trust": 3.5
},
{
"db": "BID",
"id": "40205",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "39778",
"trust": 2.6
},
{
"db": "XF",
"id": "58684",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2010-0888",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20100517 CVE-2010-1454: SPRINGSOURCE TC SERVER UNAUTHENTICATED REMOTE ACCESS TO JMX INTERFACE",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "15045",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "89655",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "89613",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "PACKETSTORM",
"id": "89613"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"id": "VAR-201005-0325",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
}
]
},
"last_update_date": "2025-04-11T23:15:42.515000Z",
"patch": {
"_id": null,
"data": [
{
"title": "CVE-2010-1454",
"trust": 0.8,
"url": "http://www.springsource.com/security/cve-2010-1454"
},
{
"title": "SpringSource tc Server JMX interface verification security bypass patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/415"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-287",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.6,
"url": "http://www.springsource.com/security/cve-2010-1454"
},
{
"trust": 2.4,
"url": "http://secunia.com/advisories/39778"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/40205"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/511307/100/0/threaded"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58684"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1454"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/xforce/xfdb/58684"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1454"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/511307/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/15045"
},
{
"trust": 0.3,
"url": "http://www.springsource.com/"
},
{
"trust": 0.3,
"url": "/archive/1/511307"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1454"
},
{
"trust": 0.1,
"url": "http://www.springsource.com/security/tc-server"
},
{
"trust": 0.1,
"url": "http://secunia.com/company/jobs/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/39778/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "PACKETSTORM",
"id": "89613"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CNVD",
"id": "CNVD-2010-0888",
"ident": null
},
{
"db": "BID",
"id": "40205",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "89655",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "89613",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2010-1454",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2010-05-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-0888",
"ident": null
},
{
"date": "2010-05-17T00:00:00",
"db": "BID",
"id": "40205",
"ident": null
},
{
"date": "2010-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"ident": null
},
{
"date": "2010-05-19T04:23:49",
"db": "PACKETSTORM",
"id": "89655",
"ident": null
},
{
"date": "2010-05-18T15:00:23",
"db": "PACKETSTORM",
"id": "89613",
"ident": null
},
{
"date": "2010-05-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201005-251",
"ident": null
},
{
"date": "2010-05-19T18:30:03.553000",
"db": "NVD",
"id": "CVE-2010-1454",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2010-05-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-0888",
"ident": null
},
{
"date": "2010-05-17T00:00:00",
"db": "BID",
"id": "40205",
"ident": null
},
{
"date": "2010-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"ident": null
},
{
"date": "2010-05-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201005-251",
"ident": null
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2010-1454",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
}
],
"trust": 0.7
},
"title": {
"_id": null,
"data": "VMware SpringSource tc Server Runtime In JMX Vulnerability to gain access to the interface",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…