[22278] in bugtraq
[LoWNOISE] Tomcat 3.2.1 ..0 DoS (WinNT)
daemon@ATHENA.MIT.EDU (ET LoWNOISE)
Thu Aug 16 21:51:08 2001
Date: Thu, 16 Aug 2001 19:10:09 -0400 (EDT)
From: ET LoWNOISE <et@cyberspace.org>
To: bugtraq@securityfocus.com
In-Reply-To: <Pine.LNX.4.30.0107241243310.24282-100000@hacksware.com>
Message-ID: <Pine.SUN.3.96.1010816185324.2148A-100000@grex.cyberspace.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
--[ LoWNOISE ] Aug/2001
--[ Jakarta-Tomcat v3.2.1 Maybe Others ]
Tested on: Apache 1.3.19 (WinNT 4.0)
The Problems:
--[Path Revealing and Method discovery ]
Example:
http://host/\index.jsp
Error: 500
Location: /index.jsp
Internal Servlet Error:
org.apache.jasper.JasperException: Unable to compile class for JSP
C:\tomcat\jakarta-tomcat-3.2.1\work\localhost_8080\_0002findex_0002ejspindex_jsp_69.java:482:
Method autenticate(java.lang.String) not found in class ENTERPRISE.login.
if(pubBean.autenticate(password) != 0)
^
C:\tomcat\jakarta-tomcat-3.2.1\work\localhost_8080\_0002findex_0002ejspindex_jsp_69.java:664:
Method
Others methods...
NOTE: This info will help debug any jsp. And maybe give you some critical
info.
--[DoS]
On multiple request of the above URL the server will crash.
Plz confirm this on other versions.
Efrain 'ET' Torres
[LoWNOISE] Colombia
et@cyberspace.org
