Bug report #513 has just been filed. You can view the report at the following URL: <http://znutar.cortexity.com/BugRatViewer/ShowReport/513> REPORT #513 Details. Project: Tomcat Category: Bug Report SubCategory: New Bug Report Class: swbug State: received Priority: high Severity: critical Confidence: public Environment: Release: Tomcat3.2 JVM Release: 1.3.0-C Operating System: Windows 2000 OS Release: SP1 Platform: Windows Synopsis: (Security)Problem accessing via HTTP without protocol Description: The response is returned as follows with the information of headers though GET request is transmitted without giving the version of protocol toward the HTTP server which Tomcat buildins. $ telnet localhost 8080 Trying 127.0.0.1... Connected to doom2000. Escape character is '^]'. GET /examples/servlets/index.html HTTP/1.0 200 OK Content-Type: text/html Content-Length: 4516 Last-Modified: Sat, 02 Dec 2000 17:47:08 GMT Servlet-Engine: Tomcat Web Server/3.2 (final) (JSP 1.1; Servlet 2.2; Java 1.3.0; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.) <!doctype html public "-//w3c//dtd html 4.0 transitional//en"> <html> <snip!> </html> Connection closed by foreign host. $ When I access the HTTP server of Apatch to be the same, Apache don't send header's information. Moreover, it is possible to get the source code of jsp as follows: $ telnet localhost 8080 Trying 127.0.0.1... Connected to doom2000. Escape character is '^]'. GET /examples/hello.jsp HTTP/1.0 200 OK Content-Type: text/plain Content-Length: 108 Last-Modified: Sat, 02 Dec 2000 15:40:27 GMT Servlet-Engine: Tomcat Web Server/3.2 (final) (JSP 1.1; Servlet 2.2; Java 1.3.0; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.) <%@ page contentType="text/html %> Hello, World! Connection closed by foreign host. $ Such behavior(specification?) of the HTTP server of Tomcat, won't there be a security problem ?Title: BugRat Report # 513
BugRat Report # 513
| Project: Tomcat | Release: Tomcat3.2 |
| Category: Bug Report | SubCategory: New Bug Report |
| Class: swbug | State: received |
| Priority: high | Severity: critical |
|
Confidence:
public
|
Submitter:
_Anonymous ( [EMAIL PROTECTED] )
Date Submitted:
Dec 3 2000, 08:16:05 CST
Responsible:
Z_Tomcat Alias ( [EMAIL PROTECTED] )
- Synopsis:
- (Security)Problem accessing via HTTP without protocol
- Environment: (jvm, os, osrel, platform)
- 1.3.0-C, Windows 2000, SP1, Windows
- Additional Environment Description:
- Report Description:
-
The response is returned as follows with the information of headers
though GET request is transmitted without giving the version of
protocol toward the HTTP server which Tomcat buildins.
$ telnet localhost 8080
Trying 127.0.0.1...
Connected to doom2000.
Escape character is '^]'.
GET /examples/servlets/index.html
HTTP/1.0 200 OK
Content-Type: text/html
Content-Length: 4516
Last-Modified: Sat, 02 Dec 2000 17:47:08 GMT
Servlet-Engine: Tomcat Web Server/3.2 (final) (JSP 1.1; Servlet 2.2; Java 1.3.0; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.)
