Interstage Application Server: Vulnerability may allow access from a non-permitted IP address. November 30th, 2010

Notes on using this web page

1. Description

When the access is restricted by IP address, the request from a non-permitted IP address may be accepted.

2. Impact

Though a specific impact depends on a system function, there is a possibility of information disclosure because the request from an unauthorized client may be acceptted.

3. Affected systems and corresponding action

3-1. Affected systems:

GP7000F, PRIMEPOWER, SPARC Enterprise, PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machines, PRIMEQUEST

3-2. Affected products and required patch

* For the solution, please refer to "3-3. Workaround".

Note: Determining the affected product

• [V6 series]
  • Solaris
    To see package information on the FJSVisas package, the following command can be run:
      pkginfo -l FJSVisas
  • Windows
    See the title in the Software Release Guide.
      [Start]
        -> [Program]
          -> [Interstage]
            -> [Application Server | Apworks]
              -> [Software Release Guide]
  • Linux
    To see package information on the FJSVisas package, the following command can be run:
      rpm -q FJSVisas
• [V7 series or later]
  Use the isprintvl command.
    isprintvl

3-3. Workaround

Adopt security measures against requests from invalid IP addresses or invalid requests accessing to Servlet container ports directly. The security measures are done by a firewall and so on.
Specifically, connections to Servlet container ports should be rejected except for the request from Web server (Web server connector). Security measures against internal threats that are connections to Servlet container ports from intranet should also be done robustly by system configurations and operations.

4. Related information

None.

5. Revision history

• November 30th, 2010: 2nd release
  • In "3. Corresponding system and Patch information", "Patch ID" was changed to "None".
  • "3-3. Workaround" was added.

• November 19th, 2010: Initial release