[UNIX] Apache Tomcat DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 11/10/05

  • Next message: SecuriTeam: "[NT] Windows Metafile SetPalette Entries Heap Overflow (MS05-053)" 
    To: list@securiteam.com
Date: 10 Nov 2005 14:47:02 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Apache Tomcat DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://tomcat.apache.org/> Apache Tomcat is "the famous servlet
    container for Java Servlet and JSP technologies released under ASL.
    Version 5.5.x is intended for servlet/jsp specification 2.4/2.0".

    Requesting numerous time consuming directory listing can cause a denial of
    service in Apache Tomcat server.

    DETAILS

    Vulnerable Systems:
     * Apache Tomcat server versions 5.5.0 to 5.5.11.

    Immune Systems:
     * Apache Tomcat server versions 5.5.12 and 5.0.28

    The vulnerability is caused due to the inefficient generation of directory
    listing for web directories that has a large number of files. By sending
    multiple concurrent requests for such a directory, it is possible to
    prevent other users from accessing the directory and causes the server to
    consume a large amount of CPU resources. The vulnerability affects only
    the directory that is being listed. Files or applications in other web
    directories are not affected.

    Successful exploitation requires that directory listing is enabled in a
    directory with a large number of files.

    Proof of concept:
     - Download Tomcat package from Tomcat archive
     - Unpack it, use default configuration
     - In webapps example dir, add some empty files (enough for the dir
    listing request to be long)
     - Thread many listing access on this directory

    Workaround:
    Upgrade to Apache Tomcat version 5.5.12 or newer.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:david.maciejak@kyxar.fr>
    David Maciejak.
    Related article can be found at: <http://secunia.com/advisories/17416/>
    http://secunia.com/advisories/17416/

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Windows Metafile SetPalette Entries Heap Overflow (MS05-053)"

    Relevant Pages