SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Tomcat Server Lets Remote Users Deny Service By Making Multiple Directory Listing Requests
SecurityTracker Alert ID:  1015147
SecurityTracker URL:  http://securitytracker.com/id/1015147
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 3 2005
Impact:   Denial of service via network
Fix Available:  Yes  Exploit Included:  Yes  
Version(s): 5.5.0 to 5.5.11
Description:   A vulnerability was reported in Tomcat. A remote user can cause denial of service conditions.

A remote user can submit multiple directory listing requests for directories that contain many files to cause denial of service conditions. The specific number of requests required was not disclosed.

Versions 5.5.12 and 5.0.28 are not affected.

David Maciejak reported this vulnerability.

Impact:   A remote user can cause denial of service conditions.
Solution:   Upgrade to version 5.5.12.
Vendor URL:  jakarta.apache.org/ (Links to External Site)
Cause:   Not specified
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] Apache Tomcat 5.5.x remote Denial Of Service

Apache Tomcat is the famous servlet container for Java Servlet and JSP 
technologies released under ASL.
Version 5.5.x is intented for servlet/jsp specification 2.4/2.0.
More information on http://tomcat.apache.org/

Description:

Many time consuming directory listing requests can cause a denial of service. 

Detection/PoC:

Vulnerable version tested are 5.5.0 to 5.5.11.
5.5.12 and 5.0.28 seems not to be impacted.

A easy way to test :
-Download Tomcat package from Tomcat archive
-Unpack it, use default configuration
-In webapps example dir, add some empty files (enough for the dir listing 
request to be long)
-Thread many listing access on this directory

Workaround:

Upgrade to version 5.5.12



David Maciejak




--------------------------------------------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC