CVE-2016-0762 in Communications Diameter Signaling Router (DSR)
Summary
by MITRE
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/03/2025
The vulnerability identified as CVE-2016-0762 represents a critical timing attack susceptibility within Apache Tomcat's realm authentication implementations across multiple versions including 6.0.x through 9.0.x release candidates. This flaw stems from the inconsistent processing of authentication requests where the system's response time varies depending on whether a user account exists within the realm configuration. When an authentication attempt is made with a non-existent username, the realm implementation fails to properly process the supplied password, creating a measurable timing difference that can be exploited by attackers to determine valid user accounts through careful observation of response delays.
The technical nature of this vulnerability aligns with CWE-203, which specifically addresses "Information Exposure Through Timing Differences," and demonstrates how cryptographic implementations can be weakened by timing variations in authentication processes. The flaw operates on the principle that legitimate authentication attempts with existing users will follow a different execution path than attempts with non-existent users, particularly in the realm's password verification logic. When a username does not exist, the system skips certain validation steps that would normally occur during password processing, resulting in a shorter execution time compared to legitimate authentication attempts.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables attackers to systematically enumerate valid user accounts within the system. Through repeated authentication attempts and timing measurements, malicious actors can distinguish between valid and invalid usernames, effectively creating a user enumeration attack vector that bypasses traditional account lockout mechanisms. This weakness is particularly concerning because it can be exploited without requiring prior knowledge of valid credentials, making it a significant threat to authentication security. The vulnerability's exploitation becomes more feasible when combined with other attack vectors such as brute force attempts or credential stuffing attacks, as the attacker can first identify valid accounts and then focus their efforts on those targets.
Default configurations that include LockOutRealm provide some mitigation by implementing account lockout mechanisms, but this protection is insufficient against sophisticated timing attacks that can be conducted over extended periods to avoid triggering lockout features. The vulnerability affects the core authentication logic of Tomcat's realm implementations, which are fundamental components used for securing web applications and services. Organizations using affected versions should consider implementing additional security controls such as rate limiting, IP address monitoring, and enhanced logging to detect potential exploitation attempts. The recommended mitigation strategy involves upgrading to patched versions of Apache Tomcat where the authentication timing behavior has been normalized to prevent timing variations that could reveal user account information. This vulnerability demonstrates the importance of maintaining consistent execution paths in security-critical code sections and aligns with ATT&CK technique T1110.003, which covers credential stuffing and password spraying attacks that can be amplified by timing-based reconnaissance methods.