tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 21984] New: - Apache Tomcat hangs for long time and server error 500 if ..%5c.. is included in request URL
Date Wed, 30 Jul 2003 02:28:06 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=21984>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=21984

Apache Tomcat hangs for long time and server error 500 if ..%5c.. is included in request URL

           Summary: Apache Tomcat hangs for long time and server error 500
                    if ..%5c.. is included in request URL
           Product: Tomcat 4
           Version: 4.1.24
          Platform: PC
               URL: http://www.jsp-servlet.net/..%5c../index.jsp or
                    http://www.jspwiki.org/..%5c../Wiki.jsp?page=About
        OS/Version: Linux
            Status: NEW
          Severity: Major
          Priority: Other
         Component: Unknown
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: kenneth.y.kwan@pccw.com


The problem occurs if Tomcat is connected through Apache Web server. My server 
environemnt is Apache 2.0.46, both mod_jk and mod_jk2, and Tomcat 4.1.24. Also 
found error log in Apache error log, i.e. "mod_jk: Error flushing"

However, using the same environment with Tomcat 4.0.6 does not found any 
problem. Also no problem if 4.1.24 is used in Standalone mode.

The problem is critical if a web server forwards all requests to Tomcat to 
handle. The ..%5c.. requests are generated by CodeRed or others to infect IIS. 
However, since tomcat cannot handle ..%5c.. requests properly, Tomcat will die 
after many such requests are received.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org


Mime
View raw message