Re: Vulnerability in Apache Tomcat

[Mark Thomas <markt () apache org>]

On 12/07/2015 00:26, Juan Martinez wrote:
> Hi everyone, i found a bug in servers Apache Tomcat who performs access at
> all directories.
> The bug is exploit by a Dork in Google, the
> PoC is: allintitle:"Directory Listing For / (directory like access"/"
> For example: allintitle:"Directory Listing For / root/"
> This Dork access with dir root whithout passwords and the servers are
> Apache Tomcat.
> I advice update the Apache Tomcat for fix this bug or control with login.
> Best Regards.
> By Rootkit.

What you have found is not a bug in Apache Tomcat but a number of users
who have enabled directory listings for their sites.

Every version of Apache Tomcat for as long as I can remember (and
certainly every release of all currently supported versions) has shipped
with directory listings disabled.

If a user enables directory listings then it is up to them to secure it
in an appropriate manner for their site. It is perfectly possible that
for some sites having directory listings enabled does not present any
security risk.

Mark


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/