Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
BEA Tuxedo Input Validation Flaws Let Remote Users Determine File Existence, Deny Service, and Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1008040
|
|
CVE Reference: CAN-2003-0621
, CAN-2003-0622
, CAN-2003-0623
(Links to External Site)
|
Updated: Dec 1 2003
|
Original Entry Date: Oct 30 2003
|
Impact: Denial of service via network, Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 6.3, 6.4, 6.5, 7.1, 8.0, 8.1
|
Description: A vulnerability was reported in the BEA Tuxedo administration console. A remote user can determine if certain files exist on the
server. A remote user can cause denial of service conditions. A remote user can also conduct cross-site scripting attacks. Certain
versions of WebLogic Enterprise are also affected.
It is reported that some of the CGI application's startup arguments are not properly validated. A remote user can supply specially
crafted values to exploit a flaw in Tuxedo.
It is reported that a user can specify a specially crafted path value to determine
if a specified file exists on the target server [CVE: CAN-2003-0621].
It is also reported that a remote user can provide a device
name in place of a valid filename to cause another user's login attempt to hang [CVE: CAN-2003-0622]. According to the report,
the stability of the server running administration console processes may be affected.
Finally, it is reported that a remote user
can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the
target user's browser [CVE: CAN-2003-0623]. The code will originate from the site running the vulnerable BEA software and will run
in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication
cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take
actions on the site acting as the target user.
BEA credits Corsaire Limited with identifying these flaws.
|
Impact: A remote user can determine if certain files exist on the server.
A remote user can cause denial of service conditions for subsequent
administrator login attempts.
A remote user can access the target user's cookies (including authentication cookies), if any,
associated with the site running the vulnerable BEA software, access data recently submitted by the target user via web form to
the site, or take actions on the site acting as the target user.
|
Solution: The vendor has provided a patch for Tuxedo 8.1 (Rolling Patch 62). For other releases, the vendor advises that you should upgrade to Tuxedo 8.1 or Contact BEA Customer Support to request a fix for the specific release that you are using.
|
Vendor URL: dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp (Links to External Site)
|
Cause: Exception handling error, Input validation error
|
Underlying OS: Linux (Red Hat), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 29 Oct 2003 23:44:04 -0500
Subject: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp
|
http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp
> SECURITY ADVISORY (BEA03-38.00)
BEA Systems reported a vulnerability in the BEA Tuxedo administration console.
The following versions are affected:
Tuxedo 8.1, Tuxedo 8.0, Tuxedo 7.1, Tuxedo 6.5, Tuxedo 6.4, Tuxedo 6.3, all platforms.
WebLogic Enterprise 5.1, WebLogic Enterprise 5.0.1 and WebLogic Enterprise 4.2, all
platforms.
It is reported that some of the CGI application's startup arguments are not properly
validated. A remote user can supply specially crafted values to exploit a flaw in Tuxedo.
It is reported that a user can specify a specially crafted path value to determine if a
specified file exists on the target server.
It is also reported that a remote user can provide a device name in place of a valid
filename to cause another user's login attempt to hang. According to the report, the
stability of the server running administration console processes may be affected.
Finally, it is reported that a remote user can submit a specially crafted filename
containing HTML code as part of a cross-site scripting attack.
BEA credits Corsaire Limited with identifying these flaws.
BEA has provided the following fix information:
For Tuxedo 8.1:
Apply Rolling Patch 62 or later.
For all other releases:
Upgrade to Tuxedo 8.1, or Contact BEA Customer Support to request a fix for the release
you are using.
> Threat level: low
> Severity: medium
|
|
Go to the Top of This SecurityTracker Archive Page
|
