full-disclosure

Open Source and information security mailing list archives

Message-ID: <55A54315.8050700@apache.org>
Date: Tue, 14 Jul 2015 19:12:53 +0200
From: Mark Thomas <markt@...che.org>
To: Juan Martinez <gus70938@...il.com>, 
	"fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Vulnerability in Apache Tomcat

On 12/07/2015 00:26, Juan Martinez wrote:
> Hi everyone, i found a bug in servers Apache Tomcat who performs access at
> all directories.
> The bug is exploit by a Dork in Google, the
> PoC is: allintitle:"Directory Listing For / (directory like access"/"
> For example: allintitle:"Directory Listing For / root/"
> This Dork access with dir root whithout passwords and the servers are
> Apache Tomcat.
> I advice update the Apache Tomcat for fix this bug or control with login.
> Best Regards.
> By Rootkit.

What you have found is not a bug in Apache Tomcat but a number of users
who have enabled directory listings for their sites.

Every version of Apache Tomcat for as long as I can remember (and
certainly every release of all currently supported versions) has shipped
with directory listings disabled.

If a user enables directory listings then it is up to them to secure it
in an appropriate manner for their site. It is perfectly possible that
for some sites having directory listings enabled does not present any
security risk.

Mark

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives