From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 10 Nov 2005 14:47:02 +0200
Subject: [UNIX] Apache Tomcat DoS
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20051110160519.A829D574F@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Apache Tomcat DoS
------------------------------------------------------------------------
SUMMARY
<http://tomcat.apache.org/>; Apache Tomcat is "the famous servlet
container for Java Servlet and JSP technologies released under ASL.
Version 5.5.x is intended for servlet/jsp specification 2.4/2.0".
Requesting numerous time consuming directory listing can cause a denial of
service in Apache Tomcat server.
DETAILS
Vulnerable Systems:
* Apache Tomcat server versions 5.5.0 to 5.5.11.
Immune Systems:
* Apache Tomcat server versions 5.5.12 and 5.0.28
The vulnerability is caused due to the inefficient generation of directory
listing for web directories that has a large number of files. By sending
multiple concurrent requests for such a directory, it is possible to
prevent other users from accessing the directory and causes the server to
consume a large amount of CPU resources. The vulnerability affects only
the directory that is being listed. Files or applications in other web
directories are not affected.
Successful exploitation requires that directory listing is enabled in a
directory with a large number of files.
Proof of concept:
- Download Tomcat package from Tomcat archive
- Unpack it, use default configuration
- In webapps example dir, add some empty files (enough for the dir
listing request to be long)
- Thread many listing access on this directory
Workaround:
Upgrade to Apache Tomcat version 5.5.12 or newer.
ADDITIONAL INFORMATION
The information has been provided by <mailto:david.maciejak@kyxar.fr.>
David Maciejak.
Related article can be found at: <http://secunia.com/advisories/17416/>;
http://secunia.com/advisories/17416/
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
