Need info on CVE-2014-0050

Hi, We are using Tomcat 7.0.40 as web server. It deploys a REST based(Jersey) web application where few requests are multipart requests. These requests accept byte array input. We tried to reproduce this vulnerability by sending more than 4091 characters in the boundary field. The request failed

Re: Need info on CVE-2014-0050

Thanks Chuck. We are not using Apache Commons FileUpload or Tomcat's implementation of FileUpload.

Re: How to prevent CVE-2012-5568 in Tomcat 7.0.32

Thanks a lot Mark for the information. Regards, Aditi

How to prevent CVE-2012-5568 in Tomcat 7.0.32

Hi, We are using Tomcat 7.0.32 in our application. During a security scan CVE-2012-5568 was reported. Is there a configuration which can help us prevent this vulnerability? I went through the http://tomcat.apache.org/security-7.html but could not find any detail on the same. Thanks

Re: Single Tomcat instance scalability

Thanks alot Chris and Mark. Regards, Aditi

Upgrading from Apache Tomcat 7.0.22 to 7.0.32

Hi, What is the best way to upgrade from Tomcat version 7.0.22 to 7.0.32? I have gone through the link http://tomcat.apache.org/migration.html but not sure what steps should be followed for upgrade. We are installing Tomcat using the zip way. Thanks Regards, Aditi

Re: Upgrading from Apache Tomcat 7.0.22 to 7.0.32

Sorry for not mentioning the platform details. The platform is windows on which upgrade has to be done.

Re: Need help to understand CVE-2007-0450

Hi Andre, Agree with your points. Just wanted to know more about “Directory Traversal Attack. Can it lead to access of directories outside Tomcat/webapps folder also or can it just try to access the applications within Tomcat/webapps folder only? Thanks Regards, Aditi

Re: Need help to understand CVE-2007-0450

Thanks Guys. As per my reading of the suggested material and looking at the logs that Andre has shared, I think there are two ways in which the directory traversal attack could be made. 1. By having ..\ equivalents in the URL itself 2. By having ..\ equivalents in the request parameters. In my

Re: Need help to understand CVE-2007-0450

*Whether someone can get access to any file/directory outside the tomcat webapps folder using Style 1 (using ..\ equivalent in the URL itself) Directory traversal attack (scoped to Tomcat) on Windows.* Have you tried this? How does Tomcat respond? I tried to access some files outside the

Re: Need help to understand CVE-2007-0450

For example, if inside of your webapps directory, you had symbolic links leading elsewhere (but I don't think that under Windows this works). *Inside webapps directory, we do not have any symbolic links.* In your normal setup, is there any front-end system in front of Tomcat, or do clients

Re: Need help to understand CVE-2007-0450

Test it yourself. Are you able to access a directory or file below the level of the webapps directory, simply by using a specially crafted request? *With our testing could not access any files/directory outside webapps folder.* Thanks Regards, Aditi

Need help to understand CVE-2007-0450

Hi, We have a web server hosted on Tomcat 7.0.22. There are two connectors defined server.xml listening at port 8080 and 8443. During vulnerability scan a 3rd party tool reported CVE-2007-0450 “Apache Tomcat Directory Traversal Attack” on both ports 8080 and 8443. The tool was able to access

Re: Need help to understand CVE-2007-0450

Is there any other workaround/solution which can help us make our application secure w.r.t this vulnerability? Thanks Regards, Aditi On Wed, Nov 21, 2012 at 8:00 PM, Mark Thomas ma...@apache.org wrote: On 21/11/2012 13:40, Aditi Sinha wrote: Hi, We have a web server hosted on Tomcat

Re: How to get heap dump of Tomcat running as windows service.

. *Any help appreciated. Thanks Regards, Aditi On Wed, Sep 12, 2012 at 3:56 PM, Konstantin Kolinko knst.koli...@gmail.comwrote: 2012/9/12 Aditi Sinha adisinha0...@gmail.com: Hi, We have web server hosted on Tomcat 7.0.22. Tomcat is running as windows service. When we try to get

Re: How to get heap dump of Tomcat running as windows service.

September 2012 13:14, Pid p...@pidster.com wrote: On 12/09/2012 11:02, Aditi Sinha wrote: Hi, We have web server hosted on Tomcat 7.0.22. Tomcat is running as windows service. When we try to get the heap dump of Tomcat using the following command *jmap -dump:format=b,file

Re: HTTP NIO connector not supporting IPv6

] Sent: Wednesday, September 12, 2012 10:00 AM To: Tomcat Users List Subject: Re: HTTP NIO connector not supporting IPv6 On Sep 12, 2012, at 1:29 AM, Aditi Sinha wrote: Thanks Dan, Jeff. There are no errors in catalina.log file. The connector tags are defined

How to get heap dump of Tomcat running as windows service.

Hi, We have web server hosted on Tomcat 7.0.22. Tomcat is running as windows service. When we try to get the heap dump of Tomcat using the following command *jmap -dump:format=b,file=heap.bin pid* we get below error *pid: Not enough storage is available to process this command.*

Re: How to support IPv6 on Apache Tomcat Version 7.0.22

Chris, Thanks for the info. I would start another email thread. Regards, Aditi On Mon, Sep 10, 2012 at 7:11 PM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Aditi, On 9/10/12 3:19 AM, Aditi Sinha wrote: Wanted to know

HTTP NIO connector not supporting IPv6

Hi, We have a web server hosted on Apache Tomcat Version 7.0.22. Machine details: Windows 2008 server machine, 32-bit OS Java version: jdk1.6.0_25 Two HTTP connectors are defined in server.xml. 1. For non-SSL requests: Connector with protocol=HTTP/1.1 (HTTP BIO connector) 2.

Re: HTTP NIO connector not supporting IPv6

). There are issues with some of the lower versions, but I don't think any that affect the connector mechanism. -Original Message- From: Aditi Sinha [mailto:adisinha0...@gmail.com] Sent: Tuesday, September 11, 2012 7:21 AM To: Tomcat Users List Subject: HTTP NIO connector

Re: How to support IPv6 on Apache Tomcat Version 7.0.22

- Hash: SHA1 Aditi, On 7/9/12 5:37 AM, Aditi Sinha wrote: I could get the comparison of the three connectors here http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#Connector_Comparison With the BIO connector specified, the server is not responding to the https request

Re: How to support IPv6 on Apache Tomcat Version 7.0.22

, 2012 at 9:58 PM, Konstantin Kolinko knst.koli...@gmail.comwrote: 2012/7/6 Aditi Sinha adisinha0...@gmail.com: Hi, We have a web server hosted on Apache Tomcat Version 7.0.22. We are trying to get the web server support IPv6. Machine details: Windows 2008 server machine, 32-bit OS

Re: How to support IPv6 on Apache Tomcat Version 7.0.22

SSL. Is there a way to have below configuration support IPv6? HTTP Connector: NIO protocol AJP Connector: APR protocol/NIO protocol. Thanks Regards, Aditi On Mon, Jul 9, 2012 at 1:04 PM, Aditi Sinha adisinha0...@gmail.com wrote: Hi Kolinko, Thank you so much. We specified the BIO connector

How to support IPv6 on Apache Tomcat Version 7.0.22

Hi, We have a web server hosted on Apache Tomcat Version 7.0.22. We are trying to get the web server support IPv6. Machine details: Windows 2008 server machine, 32-bit OS Java version: jdk1.6.0_25 The web server is not accessible using the IPv6 address. The connectivity to windows server