Uploaded image for project: 'Geronimo'
  1. Geronimo
  2. GERONIMO-3838

Close potential denial of service attack vector (OOM) in Tomcat session handling

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 2.0.2, 2.1.1
    • Fix Version/s: 2.0.3, 2.1.4, 2.2
    • Component/s: Memory Leaks, security, Tomcat
    • Security Level: public (Regular issues)
    • Labels:
      None
    • Environment:

      tested with JDK 1.5 running on Windows XP and FreeBSD6.2

    • Patch Info:
      Patch Available

      Description

      There is memory leak and it can be repeated very easily, so it should be very easy to catch

      Install Geronimo and then run some kind of benchmarking software against its admin UI login page, for example
      program ab from Apache HTTP. This is realistic attack scenario, because lot of denial of service attacks are doing this (requesting one page many times).

      Watching memory used graph in admin console shows free memory slowly decreasing. After all available memory is exhausted, application server stops serving new requests and never restores ifself back to working state.

      I think that it is caused by allocating sessions without limiting total number of sessions to keep in memory and possibly to swap sessions out to file. There needs to be user-configurable setting for preventing this, it would be nice to add such setting to Admin console.

      Its very important to get this bug fixed.

        Attachments

          Activity

            People

            • Assignee:
              drwoods Donald Woods
              Reporter:
              hsn Radim Kolar
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: