lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Jul 2015 19:12:53 +0200
From: Mark Thomas <markt@...che.org>
To: Juan Martinez <gus70938@...il.com>, 
	"fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Vulnerability in Apache Tomcat

On 12/07/2015 00:26, Juan Martinez wrote:
> Hi everyone, i found a bug in servers Apache Tomcat who performs access at
> all directories.
> The bug is exploit by a Dork in Google, the
> PoC is: allintitle:"Directory Listing For / (directory like access"/"
> For example: allintitle:"Directory Listing For / root/"
> This Dork access with dir root whithout passwords and the servers are
> Apache Tomcat.
> I advice update the Apache Tomcat for fix this bug or control with login.
> Best Regards.
> By Rootkit.

What you have found is not a bug in Apache Tomcat but a number of users
who have enabled directory listings for their sites.

Every version of Apache Tomcat for as long as I can remember (and
certainly every release of all currently supported versions) has shipped
with directory listings disabled.

If a user enables directory listings then it is up to them to secure it
in an appropriate manner for their site. It is perfectly possible that
for some sites having directory listings enabled does not present any
security risk.

Mark


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists