full-disclosure - [AppSecInc Advisory WEBSP05-V0098] Remote Buffer overflow in WebSphere Application Server Administrative Console

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42A5F5FB.6090000@appsecinc.com>
Date: Tue Jun  7 20:31:22 2005
From: shatter at appsecinc.com (Team SHATTER)
Subject: [AppSecInc Advisory WEBSP05-V0098] Remote Buffer
 overflow in WebSphere Application Server Administrative Console

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Remote Buffer overflow in WebSphere Application Server Administrative
Console

AppSecInc Team SHATTER Security Advisory WEBSP05-V0098
http://www.appsecinc.com/resources/alerts/general/WEBSPHERE-001.html
June 07, 2005

Risk level: HIGH

Credits: This vulnerability was discovered and researched by Esteban
Mart?nez Fay? of Argeniss for Application Security Inc.

Affected Versions:
IBM WebSphere Application Server 5.0

Background:
The Administrative Console is a web-based tool used to manage the IBM
WebSphere Application Server administrative server. The Administrative
Console supports a full range of product administrative activities.

Details:
There is a Unicode buffer overflow in the WebSphere Application Server
Administrative Console. The security vulnerability exists in the
authentication mechanism. The authentication process takes place only
when the 'global security option' is enabled in the server. The
vulnerability can not be exploited if the security option is disabled.
The default TCP ports where this vulnerability can be exploited
include 9080 (HTTP), 9090 (HTTP) and 9043 (HTTPS).

Impact:
Unauthenticated attackers may execute arbitrary code in the context of
the server process.

Workaround:
There is no workaround. The attack surface can be reduced by denying
access to untrusted users on TCP ports 9080, 9090 and 9043.

Vendor Status:
Vendor was contacted and a patch was released.

Fix:
Apply the WebSphere Application Server 5.0.2 Cumulative Fix 11. The
patch can be found here:
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24009775

Links:
Application Security, Inc advisory:
http://www.appsecinc.com/resources/alerts/general/WEBSPHERE-001.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)

iD8DBQFCpfX7/0w1dSVRt4URAsACAJoDG9TGi30QNOUFYv2VAdg9GaoVrQCgwBPd
e03smGG+fj/kGkJ2Ns1d6EE=
=C3Fq
-----END PGP SIGNATURE-----