Interstage Application Server: Vulnerability may allow access from a non-permitted IP address (CVE-2008-3271). October 15th, 2008

---

Notes on using this web page

1. Description

When the access control based on IP address is set, the request from a non-permitted IP address may be accepted.

2. Impact

Though a specific impact depends on a system function, there is a possibility of information disclosure because the request from an unauthorized client may be acceptted.

For the severity of this vulnerability, see JVN information in "4. Related information".

3. Affected systems and corresponding action

3-1. Affected systems:

GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, AT compatible machine, PRIMEQUEST

3-2. Affected products and required patch

* For the Patches without ID nor link, please contact a Fujitsu system engineer or your partner(s).

Note: Determining the affected product

• [V6 series]
  
  • Solaris
    To see package information on the FJSVisas package, the following command can be run:
    
    pkginfo -l FJSVisas
  • Windows
    See the title in the Software Release Guide.
    
    [Start]
      -> [Programs]
        -> [Interstage]
          -> [Application Server | Apworks]
            -> [Software Release Guide]
  • Linux
    To see package information on the FJSVisas package, the following command can be run:
    
    rpm -q FJSVisas
• [V7 series or later]
  Use the isprintvl command.
  
  isprintvl

3-3. Workaround

None.

4. Related information

This problem corresponds to vulnerability of Apache Tomcat. (JVN#30732239/ CVE-2008-3271)

• JVN#30732239
  Apache Tomcat allows access from a non-permitted IP address
  http://jvn.jp/en/jp/JVN30732239/index.html
• CVE-2008-3271
  Tomcat information disclosure vulnerability
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3271

5. Revision history

• October 15th, 2008 : 2nd edition
  Product information on the V9 series is deleted from "3-2. Affected products and required patch".
• October 10th, 2008 : Initial release