Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Server/CGI)  >   Apache Tomcat Vendors:   Apache Software Foundation
Tomcat Server Lets Remote Users Deny Service By Making Multiple Directory Listing Requests
SecurityTracker Alert ID:  1015147
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 3 2005
Impact:   Denial of service via network
Fix Available:  Yes  Exploit Included:  Yes  
Version(s): 5.5.0 to 5.5.11
Description:   A vulnerability was reported in Tomcat. A remote user can cause denial of service conditions.

A remote user can submit multiple directory listing requests for directories that contain many files to cause denial of service conditions. The specific number of requests required was not disclosed.

Versions 5.5.12 and 5.0.28 are not affected.

David Maciejak reported this vulnerability.

Impact:   A remote user can cause denial of service conditions.
Solution:   Upgrade to version 5.5.12.
Vendor URL: (Links to External Site)
Cause:   Not specified
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] Apache Tomcat 5.5.x remote Denial Of Service

Apache Tomcat is the famous servlet container for Java Servlet and JSP 
technologies released under ASL.
Version 5.5.x is intented for servlet/jsp specification 2.4/2.0.
More information on


Many time consuming directory listing requests can cause a denial of service. 


Vulnerable version tested are 5.5.0 to 5.5.11.
5.5.12 and 5.0.28 seems not to be impacted.

A easy way to test :
-Download Tomcat package from Tomcat archive
-Unpack it, use default configuration
-In webapps example dir, add some empty files (enough for the dir listing 
request to be long)
-Thread many listing access on this directory


Upgrade to version 5.5.12

David Maciejak

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC