0002950: mod_caucho open proxy and DOS

Viewing Issue Advanced Details [ Jump to Notes ]

[ View Simple ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0002950

[Resin]

major

always

09-19-08 03:06

09-23-08 13:59

Reporter

Pieter Schoenmakers

View Status

public

Assigned To

ferg

Priority

normal

Resolution

fixed

Platform

Status

closed

Projection

none

OS Version

ETA

none

Fixed in Version

3.0.25

Product Version

3.0.24

Product Build

Summary

0002950: mod_caucho open proxy and DOS

Description

mod_caucho can be turned into an open proxy. Luckily, it shoots itself in the foot in the process, turning the abuse into a mere DOS attack.

Environment:
Resin Pro 3.0.24 (licensed)
Red Hat Enterprise Linux
Sun JDK 1.5.0.16
Apache 2.0.51

Steps To Reproduce

Additional Information

Hello,

I would like to report a problem with mod_caucho. As it is a security problem, I do not want to disclose details here.

I tried to find an e-mailadres where to report the issue, but could not find any. I assume this bug tracking system to be more appropriate than sales@caucho.com. />
Please contact me by e-mail; use the e-mail address associated with this account.

Regards,
Pieter Schoenmakers

Attached Files

Relationships

Notes
(0003474) ferg 09-23-08 13:59	Applies to 3.0.25, 3.1.8, and 3.2.1.

Issue History
Date Modified	Username	Field	Change
09-19-08 03:06	Pieter Schoenmakers	New Issue
09-23-08 13:59	ferg	Note Added: 0003474
09-23-08 13:59	ferg	Assigned To	=> ferg
09-23-08 13:59	ferg	Status	new => closed
09-23-08 13:59	ferg	Resolution	open => fixed
09-23-08 13:59	ferg	Fixed in Version	=> 3.0.25

Mantis 1.0.0rc3[^]

29 total queries executed.
26 unique queries executed.