Interstage Application Server: Buffer Overflow Vulnerability(CVE-2007-6258). October 27th, 2010

Notes on using this web page

1. Description

A buffer overflow vulnerability is confirmed in the Servlet Service.

2. Impact

This vulnerability may allow a remote third person to execute arbitrary code.

For a severity assessment of this vulnerability, see National Vulnerability Database information in "4. Related information".(Japanese only).

3. Affected systems and corresponding action

3-1. Affected systems:

GP7000F, PRIMEPOWER, SPARC Enterprise, PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machines, PRIMEQUEST

3-2. Affected products and required patch

* For the Patches without ID nor link, please contact a Fujitsu system engineer or your partner(s).

Note: Determining the affected product

• [V6 series]
  • Solaris
    To see package information on the FJSVisas package, the following command can be run:
      pkginfo -l FJSVisas
  • Windows
    See the title in the Software Release Guide.
      [Start]
        -> [Program]
          -> [Interstage]
            -> [Application Server | Apworks]
              -> [Software Release Guide]
  • Linux
    To see package information on the FJSVisas package, the following command can be run:
      rpm -q FJSVisas
• [V7 series or later]
  Use the isprintvl command.
    isprintvl

3-3. Workaround

None.

4. Related information

This problem corresponds to the following vulnerabilities.

• VU#771937:
  Apache mod_jk2 host header buffer overflow
  http://www.kb.cert.org/vuls/id/771937
• NVD-ID: CVE-2007-6258
  Vulnerability Summary for CVE-2007-6258
  http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6258
• CVE-2007-6258
  Apache mod_jk2 multiple stack-based buffer overflows vulnerability
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6258

5. Revision history

• October 27th, 2010: Initial release