DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design decision? or a security vulnerability?
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698 --- Comment #3 from Edward Quick edwardqu...@hotmail.com 2011-09-02 10:35:50 UTC --- Hi there, I was testing this out to see if my site was vulnerable and got the following results. I'm not sure looking at the code comments in ForwardRequestForgeryExample.java if the output below means it's vulnerable and what exactly that exploited. Could you help me out a bit please? Thanks, Ed. C:java -cp . ForwardRequestForgeryExample Sending AJP Forward-Request Packet... End $ tail -f catalina.out Invoke HelloWorldExample.doPost method: --- Host: my.evil-site.com RemoteAddr: 1.2.3.4 LocalPort: 999 woo: I am here -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design decision? or a security vulnerability?
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698 --- Comment #4 from Mark Thomas ma...@apache.org 2011-09-02 10:49:16 UTC --- Bugzilla is not a support forum. Please use the users mailing list. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design decision? or a security vulnerability?
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698 --- Comment #5 from Edward Quick edwardqu...@hotmail.com 2011-09-02 13:04:04 UTC --- Sorry about that. Will do. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design decision? or a security vulnerability?
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698 Mark Thomas ma...@apache.org changed: What|Removed |Added Status|NEW |RESOLVED Resolution||FIXED --- Comment #2 from Mark Thomas ma...@apache.org 2011-08-29 19:45:57 UTC --- This issue has been allocated CVE-2011-3190. The Tomcat security team strongly discourages the reporting of potential security vulnerabilities via public channels such as this issue tracker. Potential security vulnerabilities should be reported privately to secur...@tomcat.apache.org This issue has been fixed in trunk, 7.0.x, 6.0.x and 5.5.x and will be included in 7.0.21, 6.0.34 and 5.5.34 onwards. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design decision? or a security vulnerability?
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698 --- Comment #1 from zhh zhh200...@gmail.com 2011-08-20 07:55:51 UTC --- Created attachment 27417 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27417 ajp Forward-Request packet forgery second example: ajp Forward-Request packet forgery -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
