Hi, Thanks for providing some amusement on my Friday morning ;) This is not a known issue because it's not an issue. Knowing tomcat's version number won't help you because there are no version-specific tomcat security holes. Furthermore, all of tomcat's built-in error pages have the exact version, i.e. even mishaps like 404's give the same result as your test. So this is not special to the % parameter either.
Yoav Shapira Millennium Research Informatics >-----Original Message----- >From: David Cassidy [mailto:[EMAIL PROTECTED] >Sent: Friday, April 16, 2004 6:10 AM >To: Tomcat Developers List >Subject: single percent sign in a parameter causes an exception report >detailing tomcat version > >Guys, > >We've had a pen test done on one of the apps we look after and they an >issue which I'd >like a little guidance on ... > >(Accept that these guys are specifically sending iffy requests to cause the >system to break or detail >what versions of the code is being used to provide ways of hacking in ..) > >If you have a page that does >request.getParameter("paramName") >and you specify > >page.jsp?paramName=% > >The result is an exception report that details what version of tomcat you >are running >(I've tried this with 4.1.29 and it does make a wonderful exception >report!) > >Anyone seen this before ? >Anyone got a fix ? > > >Thanks > >David > > > > >-- > >This e-mail may contain confidential and/or privileged information. If you >are not the intended recipient (or have received this e-mail in error) >please notify the sender immediately and destroy this e-mail. Any >unauthorized copying, disclosure or distribution of the material in this e- >mail is strictly forbidden. > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: [EMAIL PROTECTED] This e-mail, including any attachments, is a confidential business communication, and may contain information that is confidential, proprietary and/or privileged. This e-mail is intended only for the individual(s) to whom it is addressed, and may not be saved, copied, printed, disclosed or used by anyone else. If you are not the(an) intended recipient, please immediately delete this e-mail from your computer system and notify the sender. Thank you. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
