[NEWS] WebSphere Application Server Administrative Console Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 06/12/05

  • Next message: SecuriTeam: "[EXPL] WebHints Remote Command Execution (Exploit, hints.pl)" 
    To: list@securiteam.com
Date: 12 Jun 2005 11:10:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      WebSphere Application Server Administrative Console Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    "The Administrative Console is a web-based tool used to manage the IBM
    WebSphere Application Server administrative server. The Administrative
    Console supports a full range of product administrative activities."

    A buffer overflow in the WebSphere Application Server Administrative
    Console allows attackers to execute arbitrary code from remote.

    DETAILS

    Vulnerable Systems:
     * IBM WebSphere Application Server 5.0

    Immune Systems:
     * IBM WebSphere Application Server 5.0.2.11

    There is a buffer overflow in the WebSphere Application Server
    Administrative Console. The security vulnerability exists in the
    authentication mechanism. The authentication process takes place only when
    the 'global security option' is enabled in the server. The vulnerability
    can not be exploited if the security option is disabled. The default TCP
    ports where this vulnerability can be exploited include 9080 (HTTP), 9090
    (HTTP) and 9043 (HTTPS).

    Exploitation of this vulnerability allows unauthenticated attackers to
    execute arbitrary code with the context of the server process.

    Workaround:
    The attack surface can be reduced by denying access to untrusted users on
    TCP ports 9080, 9090 and 9043.

    Patch Availability:
    Apply the WebSphere Application Server 5.0.2 Cumulative Fix 11. The patch
    can be found here:
    <http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24009775>
    http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24009775.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:shatter@appsecinc.com> Team
    SHATTER.
    The original article can be found at:
    <http://www.appsecinc.com/resources/alerts/general/WEBSPHERE-001.html>
    http://www.appsecinc.com/resources/alerts/general/WEBSPHERE-001.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] WebHints Remote Command Execution (Exploit, hints.pl)"

    Relevant Pages

    • SecurityFocus Microsoft Newsletter #171
      ... Better Management for Network Security ... GoodTech Telnet Server Remote Denial Of Service Vulnerabilit... ... ASPApp PortalAPP Remote User Database Access Vulnerability ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #174
      ... This issue sponsored by: Tenable Network Security ... the worlds only 100% passive vulnerability ... MICROSOFT VULNERABILITY SUMMARY ... Novell Netware Enterprise Web Server Multiple Vulnerabilitie... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter # 150
      ... - automatically set positive security policies for real-time protection, ... MICROSOFT VULNERABILITY SUMMARY ... Meteor FTP Server USER Memory Corruption Vulnerability ... MDaemon SMTP Server Null Password Authentication Vulnerabili... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #69
      ... LANguard Security Event Log Monitor: ... MICROSOFT VULNERABILITY SUMMARY ... BrowseFTP Client Buffer Overflow Vulnerability ... Michael Lamont Savant Web Server Long Request DoS Vulnerability ...
      (Focus-Microsoft)
    • [NEWS] ePolicy Orchestrator Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... and use a Thawte Digital Certificate on your MSIIS web server. ... To attack a machine running ePO, an attacker would typically need to be ... MSDE SA account compromise - This vulnerability applies to ePO 2.X and 3.0 ...
      (Securiteam)