tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Shapira, Yoav" <Yoav.Shap...@mpi.com>
Subject RE: single percent sign in a parameter causes an exception report detailing tomcat version
Date Fri, 16 Apr 2004 12:52:55 GMT

Hi,
Thanks for providing some amusement on my Friday morning ;)

This is not a known issue because it's not an issue.  Knowing tomcat's
version number won't help you because there are no version-specific
tomcat security holes.  Furthermore, all of tomcat's built-in error
pages have the exact version, i.e. even mishaps like 404's give the same
result as your test.  So this is not special to the % parameter either.

Yoav Shapira
Millennium Research Informatics


>-----Original Message-----
>From: David Cassidy [mailto:david.cassidy@db.com]
>Sent: Friday, April 16, 2004 6:10 AM
>To: Tomcat Developers List
>Subject: single percent sign in a parameter causes an exception report
>detailing tomcat version
>
>Guys,
>
>We've had a pen test done on one of the apps we look after and they an
>issue which I'd
>like a little guidance on ...
>
>(Accept that these guys are specifically sending iffy requests to cause
the
>system to break or detail
>what versions of the code is being used to provide ways of hacking in
..)
>
>If you have a page that does
>request.getParameter("paramName")
>and you specify
>
>page.jsp?paramName=%
>
>The result is an exception report that details what version of tomcat
you
>are running
>(I've tried this with 4.1.29 and it does make a wonderful exception
>report!)
>
>Anyone seen this before ?
>Anyone got a fix ?
>
>
>Thanks
>
>David
>
>
>
>
>--
>
>This e-mail may contain confidential and/or privileged information. If
you
>are not the intended recipient (or have received this e-mail in error)
>please notify the sender immediately and destroy this e-mail. Any
>unauthorized copying, disclosure or distribution of the material in
this e-
>mail is strictly forbidden.
>
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org




This e-mail, including any attachments, is a confidential business communication, and may
contain information that is confidential, proprietary and/or privileged.  This e-mail is intended
only for the individual(s) to whom it is addressed, and may not be saved, copied, printed,
disclosed or used by anyone else.  If you are not the(an) intended recipient, please immediately
delete this e-mail from your computer system and notify the sender.  Thank you.


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org


Mime
View raw message