PT-2005-4306 · Apache · Apache Tomcat

Published 2005-11-06 · Updated 2022-05-01 · CVE-2005-3510

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.0 through 5.5.11

Description The issue allows remote attackers to cause a denial of service by consuming CPU resources via a large number of simultaneous requests to list a web directory that contains a large number of files. This is due to the expensive calls required to generate the content for the directory listings.

Recommendations For Apache Tomcat versions 5.5.0 through 5.5.11, consider disabling directory listings to prevent exploitation, especially in directories with a large number of files. As a temporary workaround, keep the number of files in each directory to a minimum. A proposed patch is expected to improve performance by caching directory listings, which would be a more permanent solution.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2005-3510

GHSA-8F4W-JWQV-5CXC

RHSA-2007:0340

RHSA-2007:1069

RHSA-2008:0261

RHSA-2008:0524

RHSA-2010:0602

Affected Products

Apache Tomcat

References · 36

• https://osv.dev/vulnerability/GHSA-8f4w-jwqv-5cxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3510 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0161.html · Vendor Advisory
• http://secunia.com/advisories/17416 · Vendor Advisory
• http://securitytracker.com/id?1015147 · Vendor Advisory
• https://github.com/apache/tomcat · Note
• http://tomcat.apache.org/security-4.html · Note
• https://web.archive.org/web/20200229175931/http://securityfocus.com/bid/15325 · Note
• http://vupen.com/english/advisories/2008/1979/references · Note
• http://securityfocus.com/archive/1/500396/100/0/threaded · Note
• https://tomcat.apache.org/security-5 · Note
• https://web.archive.org/web/20200228054210/http://securityfocus.com/archive/1/415782/30/0/threaded · Note
• http://securityfocus.com/archive/1/500412/100/0/threaded · Note