Details
Description
Fetching the URL
http://localhost:8080/auctionMonitor/auctionMonitor.jspx
causes extremely hight CPU consumption, possibly until the maximum stack depth is reached.
This could be used as a denial of service attack. Other DOS attacks on ICEfaces are possible, but this one is particularly inexpensive for the attacker because a single HTTP request causes significant CPU load.
Activity
Ted Goddard
created issue -
Ted Goddard
made changes -
Field | Original Value | New Value |
---|---|---|
Assignee | Ken Fyten [ ken.fyten ] |
Ken Fyten
made changes -
Fix Version/s | 1.7.1 [ 10122 ] | |
Assignee Priority | P2 | |
Assignee | Ken Fyten [ ken.fyten ] | Mircea Toma [ mircea.toma ] |
Priority | Major [ 3 ] | Critical [ 2 ] |
Repository | Revision | Date | User | Message |
ICEsoft Public SVN Repository | #16643 | Wed May 14 15:24:05 MDT 2008 | mircea.toma | Stop overridding the JSP compiler for *.jspx pages because Sun RI's ViewHandler relies on the JSP compiler to execute them. |
Files Changed | ||||
MODIFY
/icefaces/branches/icefaces-1.7/icefaces/samples/tutorial/dragdrop2/web/WEB-INF/web.xml
MODIFY /icefaces/branches/icefaces-1.7/icefaces/samples/tutorial/basicInputText/web/WEB-INF/web.xml MODIFY /icefaces/branches/icefaces-1.7/icefaces/samples/auctionMonitor/config/web.sunri.icefaces.ce.xml MODIFY /icefaces/branches/icefaces-1.7/icefaces/core/src/com/icesoft/faces/application/ProductInfo.java MODIFY /icefaces/branches/icefaces-1.7/icefaces/samples/tutorial/dragdrop1/web/WEB-INF/web.xml MODIFY /icefaces/branches/icefaces-1.7/icefaces/samples/tutorial/effects1/web/WEB-INF/web.xml MODIFY /icefaces/branches/icefaces-1.7/icefaces/samples/tutorial/effects2/web/WEB-INF/web.xml |
Mircea Toma
made changes -
Status | Open [ 1 ] | Resolved [ 5 ] |
Resolution | Fixed [ 1 ] |
Ken Fyten
made changes -
Security | Private [ 10001 ] |
Ken Fyten
made changes -
Priority | Critical [ 2 ] | Major [ 3 ] |
Ken Fyten
made changes -
Status | Resolved [ 5 ] | Closed [ 6 ] |
Assignee Priority | P2 | |
Assignee | Mircea Toma [ mircea.toma ] |
It looks like D2DViewHandler will delegate *.jspx pages to Sun RI handler which triggers a forward to the same page, thus going into an infinite loop.