RE: [SECURITY] Apache Tomcat 4.x JSP source disclosurevulnerabili ty

[Felipe Schnack <fe...@ritterdosreis.br>]

  Anyway, using scriptlets (JSP) is a bad pratice... good code uses only
taglibs.

On Wed, 2002-09-25 at 10:57, Rossen Raykov wrote:
> The servlets are not vulnerable since their code is under WEB-INF and is
> successfully protected from downloads.
> All other interpreted application stuff, outside of WEB-INF, like JSP are
> vulnerable since they can be downloaded as regular files but not be
> processed by the corresponding engine.
> That's why I believe Velocity should suffer from this bug in the same way
> JSP is.
> I didn't test Velocity but there is not any reason that it will be resistant
> to this exposure.
> 
> Regards,
> Rossen Raykov
> 
> > -----Original Message-----
> > From: Kent Perrier [mailto:kperrier@ev1.net]
> > Sent: Tuesday, September 24, 2002 6:59 PM
> > To: Tomcat Users List
> > Subject: Re: [SECURITY] Apache Tomcat 4.x JSP source
> > disclosurevulnerability
> > 
> > 
> > On Tue, Sep 24, 2002 at 06:52:10PM -0400, Tim Moore wrote:
> > > OK, thanks. (The BugTraq search engine wasn't working when I checked
> > > there.)
> > > 
> > > So it sounds pretty much like what I thought it was. I still don't
> > > understand why Velocity wouldn't be vulnerable to this exploit.
> > 
> > It sounds to me like it should be.  From the bugtraq post, 
> > all servlets
> > and JSPs that run in a Tomcat instance are vulnerable.  Since Velocity
> > runs under Tomcat, logically, it is vulnerable.  All other claims are
> > illogical.
> > 
> > Kent
> > 
> > --
> > To unsubscribe, e-mail:   
> > <ma...@jakarta.apache.org>
> > For additional commands, e-mail: 
> > <ma...@jakarta.apache.org>
> > 
> 
> --
> To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
> 
-- 

Felipe Schnack
Analista de Sistemas
felipes@ritterdosreis.br
Cel.: (51)91287530
Linux Counter #281893

Faculdade Ritter dos Reis
www.ritterdosreis.br
felipes@ritterdosreis.br
Fone/Fax.: (51)32303328


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>