0002950: mod_caucho open proxy and DOS

Viewing Issue Simple Details [ Jump to Notes ]

[ View Advanced ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0002950

[Resin]

major

always

09-19-08 03:06

09-23-08 13:59

Reporter

Pieter Schoenmakers

View Status

public

Assigned To

ferg

Priority

normal

Resolution

fixed

Status

closed

Product Version

3.0.24

Summary

0002950: mod_caucho open proxy and DOS

Description

mod_caucho can be turned into an open proxy. Luckily, it shoots itself in the foot in the process, turning the abuse into a mere DOS attack.

Environment:
Resin Pro 3.0.24 (licensed)
Red Hat Enterprise Linux
Sun JDK 1.5.0.16
Apache 2.0.51

Additional Information

Hello,

I would like to report a problem with mod_caucho. As it is a security problem, I do not want to disclose details here.

I tried to find an e-mailadres where to report the issue, but could not find any. I assume this bug tracking system to be more appropriate than sales@caucho.com. />
Please contact me by e-mail; use the e-mail address associated with this account.

Regards,
Pieter Schoenmakers

Attached Files

Relationships

Notes
(0003474) ferg 09-23-08 13:59	Applies to 3.0.25, 3.1.8, and 3.2.1.

Issue History
Date Modified	Username	Field	Change
09-19-08 03:06	Pieter Schoenmakers	New Issue
09-23-08 13:59	ferg	Note Added: 0003474
09-23-08 13:59	ferg	Assigned To	=> ferg
09-23-08 13:59	ferg	Status	new => closed
09-23-08 13:59	ferg	Resolution	open => fixed
09-23-08 13:59	ferg	Fixed in Version	=> 3.0.25

Mantis 1.0.0rc3[^]

29 total queries executed.
26 unique queries executed.