atom feed20 messages in org.apache.tomcat.devRe: [SECURITY] Security Vulnerabiliti...
FromSent OnAttachments
Craig R. McClanahanDec 11, 2000 5:19 pm 
Remy MaucheratDec 11, 2000 5:28 pm 
Hans BergstenDec 11, 2000 5:38 pm 
Craig R. McClanahanDec 11, 2000 5:59 pm 
Jon StevensDec 11, 2000 6:53 pm 
Jon StevensDec 11, 2000 6:54 pm 
Larry IsaacsDec 11, 2000 6:56 pm 
Nick BaumanDec 11, 2000 9:44 pm 
Kief MorrisDec 12, 2000 2:01 am 
GOMEZ HenriDec 12, 2000 2:02 am 
Brett BergquistDec 12, 2000 5:21 am 
Glenn NielsenDec 12, 2000 7:08 am 
Arieh MarkelDec 12, 2000 7:45 am 
SeanDec 12, 2000 9:07 am 
Mike AndersonDec 12, 2000 9:27 am 
Craig R. McClanahanDec 12, 2000 9:56 am 
Craig R. McClanahanDec 12, 2000 10:02 am 
av...@satori.comDec 12, 2000 1:36 pm 
Glenn NielsenDec 12, 2000 6:30 pm 
Steve DowneyDec 15, 2000 12:12 pm 
Subject:Re: [SECURITY] Security Vulnerabilities in Tomcat 3.1 and 3.2
From:Craig R. McClanahan (Crai@eng.sun.com)
Date:Dec 12, 2000 9:56:24 am
List:org.apache.tomcat.dev

Nick Bauman wrote:

On Mon, 11 Dec 2000, Craig R. McClanahan wrote:

Tomcat 3.2 final has the following security vulnerabilities that have subsequently been fixed in the CVS repository: * A URL like "http://localhost:8080/examples//WEB-INF/web.xml" can expose sensitive information (note the double slash after "examples"). * The "Show Source" custom tag used to display JSP source code can be used to expose sensitive information in WEB-INF.

BTW: I think it should be made clear this is only an issue if you are not using a webserver, like apache, in front of the Container. A properly configured apache renders these vulnerabilites moot.

I suppose that depends on the definition of "properly configured". The standard config files we generate for Apache would not protect all of the cases, although it would catch some of them.

-Nick

Craig