PT-2005-4306 · Apache · Apache Tomcat

Publicado 2005-11-06 · Atualizado 2022-05-01 · CVE-2005-3510

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.0 through 5.5.11

Description The issue allows remote attackers to cause a denial of service by consuming CPU resources via a large number of simultaneous requests to list a web directory that contains a large number of files. This is due to the expensive calls required to generate the content for the directory listings.

Recommendations For Apache Tomcat versions 5.5.0 through 5.5.11, consider disabling directory listings to prevent exploitation, especially in directories with a large number of files. As a temporary workaround, keep the number of files in each directory to a minimum. A proposed patch is expected to improve performance by caching directory listings, which would be a more permanent solution.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2005-3510

GHSA-8F4W-JWQV-5CXC

RHSA-2007:0340

RHSA-2007:1069

RHSA-2008:0261

RHSA-2008:0524

RHSA-2010:0602

Produtos afetados

Apache Tomcat

Referências · 36

• https://github.com/apache/tomcat · Nota
• http://tomcat.apache.org/security-4.html · Nota
• https://web.archive.org/web/20200229175931/http://securityfocus.com/bid/15325 · Nota
• http://vupen.com/english/advisories/2008/1979/references · Nota
• http://securityfocus.com/archive/1/500396/100/0/threaded · Nota
• https://tomcat.apache.org/security-5 · Nota
• https://web.archive.org/web/20200228054210/http://securityfocus.com/archive/1/415782/30/0/threaded · Nota
• http://securityfocus.com/archive/1/500412/100/0/threaded · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Nota
• http://securityfocus.com/archive/1/415782/30/0/threaded · Nota
• https://web.archive.org/web/20200922015809/http://securitytracker.com/id?1015147 · Nota
• https://osv.dev/vulnerability/GHSA-8f4w-jwqv-5cxc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3510 · Nota de Segurança
• http://secunia.com/advisories/33668 · Nota
• https://web.archive.org/web/20200517153851/http://securityfocus.com/archive/1/500412/100/0/threaded · Nota