Cross-site scripting (XSS) vulnerability in Interstage HTTP Server January 18th, 2008

---

Notes on using this web page

1. Background and Detected problem(s)

The following security vulnerability has been confirmed in the Interstage HTTP Server which is bundled with Interstage Application Server, Interstage Apworks and Interstage Studio.

Cross Site Scripting (XSS) vulnerability on receiving an invalid HTTP request.
This corresponds to CVE-2006-3918.

Fujitsu provides security patches shown in 3.
Please apply them as soon as possible.

2. Method to temporarily avoid the problem

In order to avoid execution of a script on a client, set the ErrorDocument Directive in the environment file (httpd.conf) to use a fixed error message for an error page corresponding to status code '417'.
Example: ErrorDocument 417 "Expectation Failed.

3. Corresponding system and Patch information

Corresponding system : GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, FMV, PRIMEQUEST

For the Patches without ID or link, please contact a Fujitsu system engineer.

4. Revision history

• January 18th, 2008 :
  
  • The following products have been added to "3. Corresponding system and Patch information":
    - Interstage Business Application Server Enterprise Edition 8.0.0 RHEL-AS4(IPF)
    - Interstage Job Workload Server 8.1.0 RHEL-AS4(IPF)
  • Stopped and Corrected patch ID in "3. Corresponding system and Patch information"
    Defects were found in patches that were released in the 2nd edition, so the release was stopped. Patches in which defects were found are shown in "Patch ID." of "3. Corresponding system and Patch information".
    The table below maps the patch for which release was stopped and the corrected version of the defective patch.

• February 6th, 2007 : Added patch ID in "3. Corresponding system and Patch information"
• October 12th, 2006 : Initial release