full-disclosure - Websphere 3.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3d50743d728c.3d728c3d5074@planet.nl>
From: yossarian at planet.nl (yossarian@...net.nl)
Subject: Websphere 3.5

Apart from not being supported by IBM any longer? Insecurities in WAS usually emerge from how you deploy it (LDAP? - remember that ldap requests are usually clear text)(and hardly anyone ever managed to get Global Security working so often the admin console is not secured), are specific to the version (*nix?, OS390?, Windows?, 3.5.6 or other fixlevel) and type (EE, AE etc...). Besides, keeping WAS 3.5 on the right fixlevel all over can really be a pain. 

Anyway I advise you to NEVER deploy Was3.5 if webfacing without some sort of EDGE technology, i.e. some reverse proxy. And of course for WAS 3.5 - go for the apache layer. It is very likely to be an older one. Then google for Apache 1.3.17 exploits. Or go to apache.org ....

Good luck

(BTW don't 0wn things you don't own)

----- Oorspronkelijk bericht -----
Van: Alerta Redsegura <alerta@...segura.com>
Datum: donderdag, oktober 21, 2004 7:25 pm
Onderwerp: [Full-Disclosure] Websphere 3.5

> Hi,
> 
> Anyone aware of vulnerabilities (besides those you can find 
> Googling) in
> Websphere 3.5?
> 
> 
> Regards,
> 
> 
> I?igo
> alerta@...segura.com
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>