Re: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
wastasy wrote: Hi everyone, I am testing an Apache Tomcat server 6.0.36 on Ubuntu Linux I would like to reproduce CVE-2012-3544 Denial of Service Vulnerability with Apache Tomcat 6.0.36 I tried to send a request using chunked transfer encoding with a web proxy (Burp proxy) but I think I am making a mistake... How can I reproduce the bug? How can I send a request using chunked transfer encoding? Can you help me please? Sending a HTTP request with chunked encoding is a decision of the HTTP client, not of the server. So you need to find a client (and a payload) that will result in such an encoding being used. Helping someone to crash servers which have maybe not been updated yet to the latest version is probably not something that a lot of us here like to be doing with their time. - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
On 27/08/2013 08:38, wastasy wrote: Hi everyone, I am testing an Apache Tomcat server 6.0.36 on Ubuntu Linux OK. I would like to reproduce CVE-2012-3544 Denial of Service Vulnerability with Apache Tomcat 6.0.36 Why? I tried to send a request using chunked transfer encoding with a web proxy (Burp proxy) but I think I am making a mistake... If that is all you are doing you will not reproduce the issue because you have not recreated the circumstances under which the vulnerability occurs. How can I reproduce the bug? Everything you need to know to recreate the bug is in the vulnerability report and on the Tomcat 6 security page. How can I send a request using chunked transfer encoding? The correct use of chunking is described in RFC2616. Mark Can you help me please? Best regards wastasy - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
I would like to reproduce CVE-2012-3544 Denial of Service Vulnerability with Apache Tomcat 6.0.36 Why? 1- I have\want to demonstrate, Apache Tomcat 6.0.36 has a DoS vulnerability 2- I am inquiring and I want to see with my eyes 3- I want to learn more about HTTP and Apache Tomcat 4- Why not? - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
On 27/08/2013 10:00, wastasy wrote: I would like to reproduce CVE-2012-3544 Denial of Service Vulnerability with Apache Tomcat 6.0.36 Why? 1- I have\want to demonstrate, Apache Tomcat 6.0.36 has a DoS vulnerability Why? It is already known, published fact that it has one. 2- I am inquiring and I want to see with my eyes OK. 3- I want to learn more about HTTP and Apache Tomcat OK. 4- Why not? There are lots of good reasons to want to do this and lots of bad ones. Those with good reason to do this are in roles where they should have the necessary skills to do this already and I have no desire to help those that do not have a good reason to do this. Mark - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
1- I have\want to demonstrate, Apache Tomcat 6.0.36 has a DoS vulnerability Why? It is already known, published fact that it has one. The extreme value theorem is already known too but million of students around the world have\want to prove it. 4- Why not? There are lots of good reasons to want to do this and lots of bad ones. Those with good reason to do this are in roles where they should have the necessary skills to do this already and I have no desire to help those that do not have a good reason to do this. I understand your reasons but I don't share it... you are forgetting the students and in particular the inquiring students. This is just my modest opinion of course. Mark thanks wastasy. - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
On 27/08/2013 10:45, wastasy wrote: 1- I have\want to demonstrate, Apache Tomcat 6.0.36 has a DoS vulnerability Why? It is already known, published fact that it has one. The extreme value theorem is already known too but million of students around the world have\want to prove it. 4- Why not? There are lots of good reasons to want to do this and lots of bad ones. Those with good reason to do this are in roles where they should have the necessary skills to do this already and I have no desire to help those that do not have a good reason to do this. I understand your reasons but I don't share it... you are forgetting the students and in particular the inquiring students. This is just my modest opinion of course. Then you won't learn anything if I just hand you the answer. You have all the information you need to recreate this. Time to do some work and figure this out for yourself. My original response provided plenty of pointers for you to make some progress. Mark - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
