httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Leo Gil" <leonardob...@gmail.com>
Subject [users@httpd] Block Tomcat's directory listing vulnerability with Directory and regex
Date Mon, 18 Dec 2006 23:26:06 GMT
Hi all,

I have been trying to block the Tomcat directory listing vulnerability
using Apache's Directory with no success.

Has anyone been able to fix that? We can't upgrade Tomcat as
recommended by the CVE, and that flaw is also present on versions above
5.5.17

Here is the vulnerability:
http://www.securityfocus.com/bid/19106/exploit

Basically any url like http://foo.com/; (with a semicolon at the end)
displays the directory files

This is what I'm trying to do:

<Directory ~ "^\;">
   AllowOverride None
   Order deny,allow
   Deny from all
   Allow from none
</Directory>

I have tried a couple different regexes but nothing worked so far

Thank you
Leo

Mime
View raw message