Web Root Path Disclosure Vulnerability in Interstage Application Server. October 9th, 2007

---

Notes on using this web page

1. Background and Detected problem(s)

Web root path disclosure vulnerability has been discovered in the Tomcat 4.1-based Servlet Service.

There is a possibility being returned the error page which contains the root path of the Web application (physical path about the document root) to the remote attackers.

2. Method to avoid the problem

Add following JavaVM option(Note1) by setting the IJServer work unit.

  -Dsun.io.useCanonCaches=false

  Note1)Set in the following input forms.

• Interstage Management Console  ->
• Interstage Application Server  ->
• System  ->
• WorkUnit  ->
• [WorkUnit(IJServer) Name]  ->
• Settings  ->
• WorkUnit Settings  ->
• Java VM Options

Fujitsu has confirmed this vulnerability as a problem of the Tomcat 4.1-based Servlet Service. However, because it was a problem concerning the JavaVM option, this problem is scheduled to be corrected in a future version of the Interstage Application Server.

3. Corresponding system and Patch information

Corresponding system :PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machine, PRIMEQUEST

Note2)For the Patches, please see "2. Method to avoid the problem".

4. Revision history

• October 9th, 2007 : Initial release