AdaCore - The GNAT Pro Company » AWS

Security Advisory SA-2012-L119-003: Hash collisions in AWS

AdaCore — Fri, 27 Jan 2012 16:14:55 +0000

Problem:

Impacted versions of AWS store key/value pairs from submitted form data in hash tables using a hash function that has predictable collisions. As a result, a single specially crafted HTTP request can cause the server to use hours of CPU time, thus causing a denial of service.

Impact:

All AWS releases and wavefronts prior to 2012-01-21

Status:

This was fixed in AWS 2.11 and 2.10.2 on 2012-01-21

References:

[AWS] Improve templates parser macro support

AdaCore — Wed, 01 Sep 2010 12:00:00 +0000

Improve macro inlining and add a tree simplifier. With this improvement most of the macro’s conditionals can be removed from the tree which increase the performance of the templates rendering.

[AWS] Add more integrated support for some headers

AdaCore — Thu, 05 Aug 2010 12:00:00 +0000

A cleaner and more structured API has been added to handle the Cache-Control HTTP header. At the same time, the support for ETag and Expires headers has been improved.

[AWS] Improve Ajax support in AWS

AdaCore — Mon, 02 Aug 2010 12:00:00 +0000

The AWS/Ajax implementation now takes advantage of the new Templates_Parser macro support. This makes Ajax more integrated into AWS and improves the user experience when working with Ajax.

[AWS] Updated Web_Block context accessible

AdaCore — Mon, 15 Feb 2010 12:00:00 +0000

It is now possible to query the updated context in the Web_Block framework. This make it possible to do specialized actions after rendering a Web page (i.e. after evaluating all the web blocks).

[AWS] Generate targetNamespace in schema when possible

AdaCore — Thu, 07 Jan 2010 12:00:00 +0000

ada2wsdl now generates a targetNamespace attribute into the schema node when all children are using the same namespace. This is to work around a Microsoft .Net toolset bug/limitation where targetNamespace into shema definitions (simpleType, complexType) are not supported.

[AWS] Port AWS to VxWorks

AdaCore — Thu, 24 Dec 2009 12:00:00 +0000

AWS can now be used on VxWorks. The build procedure has been modified to be able to build the tools on the native platform and the libraries on the cross platform.

Templates Parser User’s Guide

AdaCore — Thu, 28 May 2009 10:41:18 +0000

This is the main documentation for the AWS Templates Parser.

Browse on-line

Ada Web Server User’s Guide

AdaCore — Thu, 28 May 2009 10:19:02 +0000

This is the main documentation for AWS, the Ada Web Server library.

Browse on-line

[AWS] SOAP client stub based on persistent connection

AdaCore — Tue, 10 Mar 2009 12:00:00 +0000

New stubs using an HTTP_Connection are now generated by wsdl2aws. It is then possible to reuse a connection for multiple SOAP requests.