Suppress Servlet-Engine header info

2006-02-12 Thread Jo Pfeffer
Hi all. In the Apache config, you can change the ServerTokens directive from Full to Prod to suppress the amount of information sent with the HTTP headers - a good idea for a production system to hide the implementation details. e.g. instead of sending the full info, such as 'Server: Apache/2.0.49

Tomcat Security Vulnerabilities

2006-02-09 Thread Jo Pfeffer
Hi. Just wanting to know if anyone can tell me in which version of Tomcat the bug was fixed that allows you to enter in a URL like http://domain.com/%3f.jsp and get a directory listing. I know it exists in 3.2, just wondering which version it was fixed in. Thanks, Jo. ---