In association with heise online

26 July 2006, 11:44

Apache Tomcat divulges directory content

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

While directory listings to web servers do not directly endanger system security, attackers can use them to gain additional information about a server's structure and perhaps even a vulnerable script or interesting data. No wonder it is not possible to get a list of a directory on most servers if index.html, for instance, is not used. But by inserting a semicolon in front of a map file extension, attackers can trick Apache Tomcat into displaying the content of a directory. For example:;index.jsp .

According to a posting at the security mailing list Full Disclosure, this flaw has been confirmed for versions 5.0.28, 5.5.7, 5.5.9, and 5.5.12. Other versions up to 5.5.16 are probably also vulnerable. The weak point has been remedied in version 5.5.17. Apache Tomcat is the Java Servlet container used in the official reference implementation for Java Servlet and Java Server Pages.

Also see:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit