Cross-site scripting (XSS) vulnerabilities in Interstage Application Server(CVE-2005-2090). March 3rd, 2009

---

Notes on using this web page

1. Background and Detected problem(s)

Cross-site scripting (XSS) vulnerabilities have been discovered in the Servlet Service based on Tomca4.1 or Tomcat5.5.

This information is derived from the vulnerability on the following web site:
CVE-2005-2090: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2090

2. Method to temporarily avoid the problem

Check if both i and ii listed below are satisfied. If they are not satisfied, your system is not affected by these vulnerabilities.

1. The Web server and WorkUnit do not run on same machine.
   
   You can find this information in the following location in the Interstage Management Console.
   
     - System
       - Update System Settings
         - Detailed Settings
           - Servlet Service Settings
             - Web server and WorkUnit operating on same machine
2. The IP address of the Web server to receive requests from the Servlet container is one of the following:
   
   1. Not set.
   2. Any IP Addresses other than the Web Servers to receive requests.
      
      You can find this information in the following location in the Interstage Management Console:
      
        - System
          - WorkUnit
            - IJServer name
              - Settings
                - Web Server Connector Settings
                  - IP address of the Web server to receive requests
   If both i and ii are satisfied, entry only the Web server's IP addresses in the following location in the Interstage Management Console:
   
     - System
       - WorkUnit
         - JServer name
           - Settings
             - eb Server Connector Settings
               - IP address of the Web server to receive requests

3. Corresponding system and Patch information

Corresponding system :GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machine, PRIMEQUEST

* For the Patches without ID nor link, please contact a Fujitsu system engineer or your partner(s).

4. Revision history

• March 3rd 2009: 2nd release
  
  • Description about Servlet Service based on Tomcat5.5 has been added to the "1. Background and Detected problem(s)" .
  • Package names for the products listed below have been corrected from F3FMjs4 to F3FMjs5 in "3. Corresponding system and Patch information".
    "Interstage Studio Enterprise Edition 9.0.0 for Windows"
    "Interstage Studio Standard-J Edition 9.0.0 for Windows"
  • Some "Patch ID."s have been added in "3. Corresponding system and Patch information".
• September 6th, 2007 : Initial release