Cross site scripting (XSS) and denial of service (DoS) vulnerabilities in Interstage HTTP Server. December 25th, 2008

---

Notes on using this web page

1. Background and Detected problem(s)

The following security vulnerabilities have been detected in the Interstage HTTP Server, which is provided by Interstage Application Server, Interstage Apworks, Interstage Studio, Interstage Business Application Server, and Interstage Job Workload Server.

1. Cross site scripting (XSS) in the server status monitoring functionality
   This problem is applicable to CVE-2006-5752.
2. Denial of service (DoS) in cache functionality
   This problem is applicable to CVE-2007-1863.
3. Denial of service (DoS) in sending the specified process signals
   This problem is applicable to CVE-2007-3304.
4. Denial of service (DoS) in proxy functionality
   This problem is applicable to CVE-2007-3847.
5. Denial of service (DoS) in receiving particular requests
   This problem may occur in the following types of products:
   
   1. Windows products in which the following urgent corrections have been applied.
      - TP08940
      - TP38940
   2. The following Windows(IPF) product is applicable:
      - Interstage Application Server Enterprise Edition 8.0.0 for Windows
6. Denial of service (DoS) in the operation using SSL
   This problem may occur in the following types of products:
   
   • Solaris products in which the following urgent corrections have been applied.
     - T023AS-03

Fujitsu provides security patches shown in 3.
Please apply them as soon as possible.

2. Method to temporarily avoid the problem

None.

3. Corresponding system and Patch information

Corresponding system: GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, AT-compatible machine, PRIMEQUEST, SPARC Enterprise

Note) The effect of each vulnerability differs for each product. Please refer to the symbol in brackets following the product name and the following categories.

[a]: The effect of CVE-2006-5752
[b]: The effect of CVE-2007-1863
[c]: The effect of CVE-2007-3304
[d]: The effect of CVE-2007-3847
[e]: The effect of DoS problems in receiving particular requests
[f]: The effect of DoS problems in the operation using SSL

* For the Patches without ID nor link, please contact a Fujitsu system engineer or your partner(s).

4. Revision history

• December 25th, 2008: 3rd edition:
  
  • deleted "FMV series" of "Corresponding system"
  • The following products have been added to "3. Corresponding system and Patch information":
      Interstage Application Server Standard-J Edition V9.0.0 for Windows Windows(IPF)
  • Products which corresponded to [c], and [d] of "3. Corresponding system and Patch information" were changed.
  • "Patch ID" of "3. Corresponding system and Patch information" were changed.
    The table below maps the 2nd edition and the 3rd edition.

• January 24th, 2008: 2nd edition:
  Products which corresponded to [b], [c], and [d] of "3. Corresponding system and Patch information" were corrected.
• January 22nd, 2008: Initial release