You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2011/08/20 09:54:08 UTC
DO NOT REPLY [Bug 51698] New: ajp CPing/Forward-Request packet
forgery, is a design decision? or a security vulnerability?
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
Bug #: 51698
Summary: ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Product: Tomcat 7
Version: 7.0.20
Platform: PC
OS/Version: Windows XP
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
AssignedTo: dev@tomcat.apache.org
ReportedBy: zhh200910@gmail.com
Classification: Unclassified
Created attachment 27416
--> https://issues.apache.org/bugzilla/attachment.cgi?id=27416
ajp CPing packet forgery example
because the ajp "Data" packet no "CodeType"
and tomcat adopts lazy-reading strategy for reading ajp "Data" packet，
(i.e., if you don't invoke request.getParameter("XXX")，tomcat does't read post
request "Data" packet)
so，the current "Data" packet keeping in the socket inputstream，
the connection is keep-alive, ajp bio/nio procesor reading the next packet，
this time, is "Data" packet。
if the first byte of "Data" packet'length is 0x02(Code Type of Forward Request
Packet) or 0x0A(Code Type of CPing Packet)，
then tomcat will be in trouble.
please see the attachments.
firt example: ajp CPing packet forgery example
second example: ajp Forward-Request packet forgery
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery,
is a design decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
--- Comment #3 from Edward Quick <ed...@hotmail.com> 2011-09-02 10:35:50 UTC ---
Hi there, I was testing this out to see if my site was vulnerable and got the
following results. I'm not sure looking at the code comments in
ForwardRequestForgeryExample.java if the output below means it's vulnerable and
what exactly that exploited. Could you help me out a bit please?
Thanks,
Ed.
C:>java -cp . ForwardRequestForgeryExample
Sending AJP Forward-Request Packet...
End
$ tail -f catalina.out
Invoke HelloWorldExample.doPost method:
-------------------------------------------
Host: my.evil-site.com
RemoteAddr: 1.2.3.4
LocalPort: 999
woo: I am here
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 51698] ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|Servlet & JSP API |Connectors
Version|6.0.8 |7.0.20
Product|Tomcat 6 |Tomcat 7
Target Milestone|default |---
OS| |All
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 51698] ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
李智 <13...@139.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |13813399367@139.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery,
is a design decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #2 from Mark Thomas <ma...@apache.org> 2011-08-29 19:45:57 UTC ---
This issue has been allocated CVE-2011-3190.
The Tomcat security team strongly discourages the reporting of potential
security vulnerabilities via public channels such as this issue tracker.
Potential security vulnerabilities should be reported privately to
security@tomcat.apache.org
This issue has been fixed in trunk, 7.0.x, 6.0.x and 5.5.x and will be included
in 7.0.21, 6.0.34 and 5.5.34 onwards.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery,
is a design decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
--- Comment #1 from zhh <zh...@gmail.com> 2011-08-20 07:55:51 UTC ---
Created attachment 27417
--> https://issues.apache.org/bugzilla/attachment.cgi?id=27417
ajp Forward-Request packet forgery
second example: ajp Forward-Request packet forgery
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Posted by Mark Thomas <ma...@apache.org>.
On 15/10/2012 10:21, bugzilla@apache.org wrote:
> https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
>
> zhanqili <zh...@163.com> changed:
This idiot ^^^^^ has had their BZ account locked for messing about with
this bug. I have restored the original values.
Mark
>
> What |Removed |Added
> ----------------------------------------------------------------------------
> Component|Connectors |Servlet & JSP API
> Version|7.0.20 |6.0.8
> Product|Tomcat 7 |Tomcat 6
> Target Milestone|--- |default
> OS|Windows XP |Windows Server 2008
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 51698] ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
zhanqili <zh...@163.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|Connectors |Servlet & JSP API
Version|7.0.20 |6.0.8
Product|Tomcat 7 |Tomcat 6
Target Milestone|--- |default
OS|Windows XP |Windows Server 2008
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery,
is a design decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
--- Comment #5 from Edward Quick <ed...@hotmail.com> 2011-09-02 13:04:04 UTC ---
Sorry about that. Will do.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51698] ajp CPing/Forward-Request packet forgery,
is a design decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
--- Comment #4 from Mark Thomas <ma...@apache.org> 2011-09-02 10:49:16 UTC ---
Bugzilla is not a support forum. Please use the users mailing list.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 51698] ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
--- Comment #6 from Jackie Rosen <ja...@hushmail.com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
RE: [Bug 51698] ajp CPing/Forward-Request packet forgery, is a
design decision? or a security vulnerability?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: bugzilla@apache.org [mailto:bugzilla@apache.org]
> Subject: [Bug 51698] ajp CPing/Forward-Request packet forgery, is a design decision?
> or a security vulnerability?
> https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
> Christopher Schultz <ch...@christopherschultz.net> changed:
> What |Removed |Added
> ----------------------------------------------------------------------------
> CC|13813399367@139.com |
I was going to remove that seemingly bogus e-mail address last night, but a little research showed that it is in fact valid and typical for 139.com. Although it's pretty pointless to add yourself to a closed bugzilla entry...
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 51698] ajp CPing/Forward-Request packet forgery, is a design
decision? or a security vulnerability?
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698
Christopher Schultz <ch...@christopherschultz.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC|13813399367@139.com |
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org