Cross-site scripting (XSS) vulnerabilities in Interstage Application Server. November 16th, 2010

Notes on using this web page

1. Background and Detected problem(s)

Cross-site scripting (XSS) vulnerabilities have been discovered in the Servlet Service and in the Servlet Service for Interstage Management Console(*).

(*)Note: Depending on the product version that you are using, Servlet Service for Interstage Management Console may be referred to as Servlet Service for Interstage Operation Management.

2. Method to temporarily avoid the problem

2.1 Temporary Solution for Tomcat 3.1-based Servlet service(*)

Set error pages for both HTTP status codes 404 and 500 in the Web application environment definition file (deployment descriptor: web.xml) of Servlet Service. (Make settings only. You do not have to store the resources specified with the Location tag.)
If you change any settings, you must restart the Servlet Service. Restart by the usual method.

(*)Note: In this case, "Servlet service" refers to V3 series-V5 series Servlet service or old versions of Servlet service included in V6 series-V7 series.

2.1.1 Changing Settings of Tomcat 3.1-based Servlet service
The Web application environment definition file (deployment descriptor: web.xml) of the Tomcat 3.1-based Servlet Service is stored in the following location:

• Windows
  < Interstage installation folder >\F3FMjs2\conf\web.xml

• Solaris/Linux
  /opt/FJSVjs2/conf/web.xml

Make the error page setting after the final line of the mime-mapping setting.

< example > Web application environment definition file (deployment descriptor: web.xml) of Tomcat 3.1-based Servlet Service.
  < web-app >
             ：
             ： 
       < mime-mapping > 
             < extension > 
               mpv2 
             < /extension >  
             < mime-type > 
               video/mpeg2 
             < /mime-type > 
       < /mime-mapping > 

     < error-page > 
           < error-code >
             404 
           < /error-code > 
           < location > 
             /error/http/404.html（specify an optional page.） 
           < /location > 
      < /error-page >
      < error-page > 
           < error-code > 
              500 
           < /error-code > 
       < location > 
             /error/http/500.html（specify an optional page.） 
           < /location > 
       < /error-page > 

   < /web-app >

2.2 Temporary Solution for Tomcat 4.1-based Servlet service(*)

Set error pages for both HTTP status codes 404 and 500 in the default Web application environment definition file (deployment descriptor: web.xml) of each IJServer. (Make settings only. You do not have to store the resources specified with the Location tag.) If you change any settings, you must restart each IJServer. Restart by the usual method.

(*)Note: In this case, "Servlet service" refers to Servlet service of V6 series-V8 series.

2.2.1 Changing Settings of Tomcat 4.1-based Servlet service

The default Web application environment definition file (deployment descriptor: web.xml) of the IJServer is stored in the following location:

• Windows
  < J2EE common directory >\ijserver\[IJServer-name]\web.xml

• Solaris/Linux
  /opt/FJSVj2ee/var/deployment/ijserver/[IJServer-name]/web.xml

Make the error page setting after the final line of the welcome-file-list setting.

< example >The default Web application environment definition file (deployment descriptor: web.xml) of the IJServer. 
   < web-app > 
             ：
             ： 
       < welcome-file-list >  
             < welcome-file >index.html< /welcome-file > 
             < welcome-file >index.htm< /welcome-file > 
             < welcome-file >index.jsp< /welcome-file > 
       < /welcome-file-list > 

       < error-page > 
             < error-code > 
               404 
             < /error-code > 
             < location >
               /error/http/404.html（specify an optional page.） 
             < /location > 
       < /error-page > 
       < error-page > 
             < error-code > 
               500 
             < /error-code > 
             < location >
               /error/http/500.html（specify an optional page.） 
             < /location > 
       < /error-page > 

   < /web-app >

2.3 Temporary Solution for Servlet Service for Interstage Management Console

Set error pages for both HTTP status codes 404 and 500 in the Web application environment definition file (deployment descriptor: web.xml) of Servlet Service for Interstage Management Console. (Make settings only. You do not have to store the resources specified with the Location tag.) If you change any settings, you must restart the Servlet Service for Interstage Management Console. For details on restarting, refer to Interstage Application Server Operator's Guide.

2.3.1 Changing Settings of Servlet Service for Interstage Management Console

The Web application environment definition file (deployment descriptor: web.xml) of the Servlet Service for Interstage Management Console is stored in the following location:

• Windows
  < Interstage installation folder >\F3FMjs2su\conf\web.xml

• Solaris/Linux
  /opt/FJSVjs2su/conf/web.xml

Make the error page setting after the final line of the mime-mapping setting.

< example >Web application environment definition file (deployment descriptor: web.xml) of Servlet Service for Interstage Management Console. 

   < web-app > 
             ：
             ： 
       < mime-mapping > 
            < extension > 
              mpv2 
            < /extension > 
            < mime-type > 
              video/mpeg2 
            < /mime-type > 
       < /mime-mapping > 

       < error-page > 
            < error-code > 
              404 
            < /error-code > 
            < location >
              /error/http/404.html（specify an optional page.） 
            < /location > 
       < /error-page > 
       < error-page > 
            < error-code > 
              500 
            < /error-code > 
            < location >
              /error/http/500.html（specify an optional page.） 
            < /location > 
       < /error-page > 

   < /web-app >

3. Corresponding system and Patch information

Corresponding system : GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machine, PRIMEQUEST

* For the Patches without ID nor link, please contact a Fujitsu system engineer or your partner(s).

4. Acknowledgment

• We thank Daiki Fukumori of Secure Sky Technology.Inc for notifying us of this vulnerability.

5. Revision history

• November 16th, 2010:
  • Added target OS listed below in "3. Corresponding system and Patch information".
    "Interstage Application Server Enterprise Edition 6.0"   "Solaris 7"
• March 3rd, 2009:
  • The patch ID that is not released for the following product has been deleted from "3. Corresponding system and Patch information".
    "Interstage Application Server Enterprise Edition V6.0 for Linux "T00274-06"
  • Some "Patch ID."s have been added in "3. Corresponding system and Patch information".
• May 31st, 2007 : Added some "Patch ID." in "3. Corresponding system and Patch information".
• March 19th, 2007 : Initial release