Tomcat Server Lets Remote Users Deny Service By Making Multiple Directory Listing Requests
|
|
SecurityTracker Alert ID: 1015147
|
|
SecurityTracker URL: http://securitytracker.com/id?1015147
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 3 2005
|
Impact: Denial of service via network
|
Fix Available: Yes
Exploit Included: Yes
|
Version(s): 5.5.0 to 5.5.11
|
Description: A vulnerability was reported in Tomcat. A remote user can cause denial of service conditions.
A remote user can submit multiple directory listing requests for directories that contain many files to cause denial of service conditions.
The specific number of requests required was not disclosed.
Versions 5.5.12 and 5.0.28 are not affected.
David Maciejak reported
this vulnerability.
|
Impact: A remote user can cause denial of service conditions.
|
Solution: Upgrade to version 5.5.12.
|
Vendor URL: jakarta.apache.org/ (Links to External Site)
|
Cause: Not specified
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: David Maciejak <david.maciejak@kyxar.fr>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 3 Nov 2005 08:13:04 +0100
From: David Maciejak <david.maciejak@kyxar.fr>
Subject: [Full-disclosure] Apache Tomcat 5.5.x remote Denial Of Service
|
Apache Tomcat is the famous servlet container for Java Servlet and JSP
technologies released under ASL.
Version 5.5.x is intented for servlet/jsp specification 2.4/2.0.
More information on http://tomcat.apache.org/
Description:
Many time consuming directory listing requests can cause a denial of service.
Detection/PoC:
Vulnerable version tested are 5.5.0 to 5.5.11.
5.5.12 and 5.0.28 seems not to be impacted.
A easy way to test :
-Download Tomcat package from Tomcat archive
-Unpack it, use default configuration
-In webapps example dir, add some empty files (enough for the dir listing
request to be long)
-Thread many listing access on this directory
Workaround:
Upgrade to version 5.5.12
David Maciejak
--------------------------------------------------------------------------------
KYXAR.FR - Mail envoyé depuis http://webmail.kyxar.fr
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
