Java Servlet Engines

Java Servlet Engines April 2003 Although JSP has a tiny fraction of the installed base of PHP and ASP, and numbers of specialist servlet web servers are completely dwarfed by Apache and Microsoft-IIS, Java related technology has a much bigger impact on the Web than the raw site numbers suggest. Over the last year JSP has been the fastest growing scripting technology after ASP.NET. JSP sites are often bigger, more complex, and better funded and run by larger organisations than sites using the more common scripting technologies.

The higher investment on these sites makes them attractive targets for hosting and site development companies, while the relatively large number of players in the application server market means that they are likely recipients of competitive upgrade offers. With Windows 2003 launching later on this month and providing some application server functionality out of the box, it is also likely that Java based sites will be strenuously encouraged to evaluate the .Net Framework.

Tracking sites using Java based application servers is not straightforward, and often requires inspection of the site content. In particular, sites using Microsoft-IIS or Netscape-Enterprise as a web server may be running servlet engines that do not provide a signature in the HTTP server header and tracking these servers has to be done through analysis of the site content.

With the proviso that a better and more accurate view can be had by taking more content from the site, and that sites using Servlet Engines with Apache, Microsoft and SunONE web servers would be not be included by this view, it is still possible to take a quick and simple view of what is going on from the HTTP server headers.

Java Servlet Engines, April 2003

Engine

By IP Address

By Site

Ratio
Tomcat 9253 64532 6.97
Resin 9059 138664 15.31
IBM 9049 38730 4.28
Oracle 5156 18072 3.51
WebLogic 1716 6819 3.97
Orion 1062 6358 5.99
Jetty 635 1865 2.94
JavaWebServer 388 949 2.45
SilverStream 370 966 2.61
JRun (*) 264 17859  67.65
 

From the table, Resin, Tomcat, IBM and Oracle are popular choices for those websites that support Java-based web applications.

This is not an exhaustive list of servlet engines - for example some older engines, such as Apache JServ, still have a wide presence across the net, but are now deprecated in favour of newer implementations.

(*) The high ratio of sites per address for JRun are caused by two hosts that support many thousands of sites.

Apache/2.0.45 released to counter Denial of Service vulnerability

The Apache Project have announced that versions of Apache/2.0 up to and including Apache/2.0.44 are vulnerable to a denial of service attack. To fix the problem, the project has released Apache/2.0.45 which is available for download.

People running Apache servers should note that the vulnerability only applies to Apache/2.0 and not Apache/1.3. In this respect the bug is not a big threat to the stability of the web - it is a denial of service rather than a remote compromise and the number of sites running Apache/2.0 is relatively small. Almost 99% of Apache sites are on Apache/1.3 or earlier.

Netcraft to conform to new Internet Security RFC

Since we started the Web Server Survey in 1995, a longstanding theme of Netcraft's internet exploration work has been the issue of how best to reassure webmasters and systems administrators that requests they may see originating from Netcraft's network are benign, and do not in any way convey aggressive intent.

Earlier today an RFC was published by Internet pioneer Steve Bellovin which addresses this scenario. Bellovin's idea is that the sender's intentions, whether good or bad, should be stated directly in the TCP header information using a security flag [termed the "evil bit" by Bellovin]. It is intended that network protection devices such as routers, firewalls and Intrusion Detection Systems should defend their networks against packets where the evil bit is set, but otherwise assume that traffic is benign. Groups aligning themselves with RFC 3514 include the FreeBSD project, [who have already coded an implementation] and the nmap scanner.

Continue reading

Windows 2000 Exploits Published and Generalised

Further to our article on the widespread availability of WebDAV on Microsoft-IIS/5.0 sites, Roman Medina and Rafael Nunez have each published the sources to programs written to exploit the vulnerability.

Additionally, David Litchfield has produced a paper emphasizing that the problem is a core DLL in Windows 2000 that is possible to exploit without recourse to the published Microsoft-IIS WebDAV vulnerability.

Expert opinion is that no unpatched Windows 2000 machines are safe.

Netcraft's network exploration services may be useful for people managing large networks of Windows 2000 servers. In particular, we can report machines not yet rebooted since the availability of Microsoft's patch and determine availability of WebDAV functionality on those machines.

Please mail us if interested.