Interstage Application Server: Vulnerable in request processing. May 17th, 2010

---

Notes on using this web page

1. Description

There is a vulnerability in Servlet service included in Interstage Application Server in which a specific request may be not processed properly.

Fujitsu provide security patches listed in 3 below.
Please apply them as soon as possible.

2. Impact

The specific impact depends on the implementation of the web application.
The following things may happen.

• illegal request execution
• information leak of other users

For the severity of this vulnerability, see JVN/IPA information in "4. Related information"(Japanese only).

3. Affected systems and corresponding action

3-1. Affected systems:

GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machine

3-2. Affected products and required patch

Note: In the following products, this vulnerability ONLY affects the system with Servlet service which has compatiblity with version 5 and earlier. This service is set by custom install. Therefore, the system with Servlet service set by default install is NOT affected by this vulnerability.

• Interstage Application Server V6 series-V7 series

Note: Determining the affected product

• [V3 series-V6 series]
  
  • Solaris
    Ensure package information on the FJSVisas package.
      pkginfo -l FJSVisas
  • Windows
    Ensure the title of Software Release Guide.
      [Start]
        -> [Program]
          -> [Interstage]
            -> [Application Server]
              -> [Software Release Guide]
  • Linux
    Ensure package information on the FJSVisas package.
      rpm -q FJSVisas
• [V7 series or later]
  Use the isprintvl command.
    isprintvl

3-3. Workaround

Set five minutes or more interval for the distribution beginning time of each server at the loading balancer.

4. Related information

This problem corresponds to vulnerability of Interstage Application Server. (JVN#90248889)

• JVN#90248889:
  Interstage Application Server vulnerable in request processing
  http://jvn.jp/jp/JVN90248889/index.html(Japanese only)

5. Revision history

• May 17th, 2010 : Initial release