Details of VAR-200802-0286

ID

VAR-200802-0286

CVE

CVE-2008-1040

TITLE

Fujitsu Interstage Application Server Single Sign-On Buffer Overflow Vulnerability

Trust: 1.1

sources: BID: 27966 // JVNDB: JVNDB-2008-001575

DESCRIPTION

Buffer overflow in the Single Sign-On function in Fujitsu Interstage Application Server 8.0.0 through 8.0.3 and 9.0.0, Interstage Studio 8.0.1 and 9.0.0, and Interstage Apworks 8.0.0 allows remote attackers to execute arbitrary code via a long URI. Fujitsu Interstage Application Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Attackers may leverage this issue to execute arbitrary code in the context of the affected application. Failed attacks will likely cause denial-of-service conditions. This issue affects the following applications: Interstage Application Server Enterprise Edition 8.0.0, 8.0.1, 8.0.2, 8.0.3, 9.0.0, and 9.0.0A Interstage Application Server Standard-J Edition 8.0.0, 8.0.1, 8.0.2, 8.0.3, 9.0.0, and 9.0.0A Interstage Apworks Enterprise Edition 8.0.0 Interstage Apworks Standard-J Edition 8.0.0 Interstage Studio Enterprise Edition 8.0.1 and 9.0.0 Interstage Studio Standard-J Edition 8.0.1 and 9.0.0. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Interstage Application Server Single Sign-On Buffer Overflow SECUNIA ADVISORY ID: SA29088 VERIFY ADVISORY: http://secunia.com/advisories/29088/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Interstage Application Server 8.x http://secunia.com/product/13685/ Interstage Application Server 9.x http://secunia.com/product/15986/ DESCRIPTION: A vulnerability has been reported in Interstage Application Server, which can be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the Single Sign-on function. This can be exploited to cause a buffer overflow by sending a specially crafted request to the server. Successful exploitation allows execution of arbitrary code. Please see the vendor advisory for a list of affected products. SOLUTION: Please see the vendor advisory for a workaround. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.fujitsu.com/global/support/software/security/products-f/interstage-200804e.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.98

sources: NVD: CVE-2008-1040 // JVNDB: JVNDB-2008-001575 // BID: 27966 // PACKETSTORM: 64037

AFFECTED PRODUCTS

vendor:	fujitsu	model:	interstage application server enterprise	scope:	eq	version:	8.0.0	Trust: 1.6
vendor:	fujitsu	model:	interstage application server enterprise	scope:	eq	version:	v9.0.0	Trust: 1.6
vendor:	fujitsu	model:	interstage application server enterprise	scope:	eq	version:	v9.0.0a	Trust: 1.6
vendor:	fujitsu	model:	interstage application server enterprise	scope:	eq	version:	8.0.2	Trust: 1.6
vendor:	fujitsu	model:	interstage application server enterprise	scope:	eq	version:	8.0.1	Trust: 1.6
vendor:	fujitsu	model:	interstage application server standard j	scope:	eq	version:	8.0.3	Trust: 1.0
vendor:	fujitsu	model:	interstage apworks standard j	scope:	eq	version:	8.0.0	Trust: 1.0
vendor:	fujitsu	model:	interstage application server standard j	scope:	eq	version:	v9.0.0a	Trust: 1.0
vendor:	fujitsu	model:	interstage apworks enterprise	scope:	eq	version:	8.0.0	Trust: 1.0
vendor:	fujitsu	model:	interstage studio enterprise	scope:	eq	version:	8.0.1	Trust: 1.0
vendor:	fujitsu	model:	interstage studio standard j	scope:	eq	version:	8.0.1	Trust: 1.0
vendor:	fujitsu	model:	interstage studio enterprise	scope:	eq	version:	v9.0.0	Trust: 1.0
vendor:	fujitsu	model:	interstage application server standard j	scope:	eq	version:	8.0.0	Trust: 1.0
vendor:	fujitsu	model:	interstage application server standard j	scope:	eq	version:	8.0.2	Trust: 1.0
vendor:	fujitsu	model:	interstage application server standard j	scope:	eq	version:	v9.0.0.0	Trust: 1.0
vendor:	fujitsu	model:	interstage studio standard j	scope:	eq	version:	v9.0.0	Trust: 1.0
vendor:	fujitsu	model:	interstage application server enterprise	scope:	eq	version:	8.0.3	Trust: 1.0
vendor:	fujitsu	model:	interstage application server	scope:	-	version:	-	Trust: 0.8
vendor:	fujitsu	model:	interstage apworks	scope:	-	version:	-	Trust: 0.8
vendor:	fujitsu	model:	interstage business application server	scope:	-	version:	-	Trust: 0.8
vendor:	fujitsu	model:	interstage job workload server	scope:	-	version:	-	Trust: 0.8
vendor:	fujitsu	model:	interstage studio	scope:	-	version:	-	Trust: 0.8
vendor:	fujitsu	model:	interstage studio standard-j edition	scope:	eq	version:	9.0	Trust: 0.3
vendor:	fujitsu	model:	interstage studio standard-j edition	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage studio enterprise edition	scope:	eq	version:	9.0	Trust: 0.3
vendor:	fujitsu	model:	interstage studio enterprise edition	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage apworks standard-j edition	scope:	eq	version:	8.0	Trust: 0.3
vendor:	fujitsu	model:	interstage apworks enterprise edition	scope:	eq	version:	8.0	Trust: 0.3
vendor:	fujitsu	model:	interstage application server standard-j edition a	scope:	eq	version:	9.0	Trust: 0.3
vendor:	fujitsu	model:	interstage application server standard-j edition	scope:	eq	version:	9.0	Trust: 0.3
vendor:	fujitsu	model:	interstage application server standard-j edition	scope:	eq	version:	8.0.3	Trust: 0.3
vendor:	fujitsu	model:	interstage application server standard-j edition	scope:	eq	version:	8.0.2	Trust: 0.3
vendor:	fujitsu	model:	interstage application server standard-j edition	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage application server standard-j edition	scope:	eq	version:	8.0	Trust: 0.3
vendor:	fujitsu	model:	interstage application server enterprise edition a	scope:	eq	version:	9.0	Trust: 0.3
vendor:	fujitsu	model:	interstage application server enterprise edition	scope:	eq	version:	9.0	Trust: 0.3
vendor:	fujitsu	model:	interstage application server enterprise edition	scope:	eq	version:	8.0.3	Trust: 0.3
vendor:	fujitsu	model:	interstage application server enterprise edition	scope:	eq	version:	8.0.2	Trust: 0.3
vendor:	fujitsu	model:	interstage application server enterprise edition	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage application server enterprise edition	scope:	eq	version:	8.0	Trust: 0.3

sources: BID: 27966 // JVNDB: JVNDB-2008-001575 // CNNVD: CNNVD-200802-474 // NVD: CVE-2008-1040

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-1040
value:	HIGH
Trust: 1.0
NVD:	CVE-2008-1040
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200802-474
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2008-1040
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

sources: JVNDB: JVNDB-2008-001575 // CNNVD: CNNVD-200802-474 // NVD: CVE-2008-1040

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2008-001575 // NVD: CVE-2008-1040

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200802-474

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200802-474

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-001575

PATCH

title:

interstage_as_200804

url:

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200804e.html

Trust: 0.8

sources: JVNDB: JVNDB-2008-001575

EXTERNAL IDS

db:	NVD	id:	CVE-2008-1040	Trust: 2.7
db:	BID	id:	27966	Trust: 2.7
db:	SECUNIA	id:	29088	Trust: 2.5
db:	JVNDB	id:	JVNDB-2008-001575	Trust: 1.6
db:	VUPEN	id:	ADV-2008-0662	Trust: 1.6
db:	CNNVD	id:	CNNVD-200802-474	Trust: 0.6
db:	PACKETSTORM	id:	64037	Trust: 0.1

sources: BID: 27966 // JVNDB: JVNDB-2008-001575 // PACKETSTORM: 64037 // CNNVD: CNNVD-200802-474 // NVD: CVE-2008-1040

REFERENCES

url:	http://secunia.com/advisories/29088	Trust: 2.4
url:	http://www.securityfocus.com/bid/27966	Trust: 2.4
url:	http://www.fujitsu.com/global/support/software/security/products-f/interstage-200804e.html	Trust: 2.0
url:	http://www.frsirt.com/english/advisories/2008/0662	Trust: 1.4
url:	http://www.vupen.com/english/advisories/2008/0662	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1040	Trust: 0.8
url:	http://jvndb.jvn.jp/ja/contents/2008/jvndb-2008-001575.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-1040	Trust: 0.8
url:	http://www.fujitsu.com/global/services/software/interstage/	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/15986/	Trust: 0.1
url:	https://psi.secunia.com/?page=changelog	Trust: 0.1
url:	https://psi.secunia.com/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1
url:	http://secunia.com/product/13685/	Trust: 0.1
url:	http://secunia.com/advisories/29088/	Trust: 0.1

sources: BID: 27966 // JVNDB: JVNDB-2008-001575 // PACKETSTORM: 64037 // CNNVD: CNNVD-200802-474 // NVD: CVE-2008-1040

CREDITS

The vendor disclosed this issue.

Trust: 0.9

sources: BID: 27966 // CNNVD: CNNVD-200802-474

SOURCES

db:	BID	id:	27966
db:	JVNDB	id:	JVNDB-2008-001575
db:	PACKETSTORM	id:	64037
db:	CNNVD	id:	CNNVD-200802-474
db:	NVD	id:	CVE-2008-1040

LAST UPDATE DATE

2024-08-14T15:09:23.681000+00:00

SOURCES UPDATE DATE

db:	BID	id:	27966	date:	2015-05-07T17:32:00
db:	JVNDB	id:	JVNDB-2008-001575	date:	2008-09-03T00:00:00
db:	CNNVD	id:	CNNVD-200802-474	date:	2008-09-05T00:00:00
db:	NVD	id:	CVE-2008-1040	date:	2011-03-08T03:05:50.703

SOURCES RELEASE DATE

db:	BID	id:	27966	date:	2008-02-25T00:00:00
db:	JVNDB	id:	JVNDB-2008-001575	date:	2008-09-03T00:00:00
db:	PACKETSTORM	id:	64037	date:	2008-02-26T19:03:01
db:	CNNVD	id:	CNNVD-200802-474	date:	2008-02-27T00:00:00
db:	NVD	id:	CVE-2008-1040	date:	2008-02-27T19:44:00