Fwd: TmaxSoft JEUS Alternate Data Streams Vulnerability

2008-12-16T00:00:00
ID SECURITYVULNS:DOC:21030
Type securityvulns
Reporter Securityvulns
Modified 2008-12-16T00:00:00

Description

Dear bugtraq,

Thanks for your concern.

I saw BID 32804.

It is one incorrect information.

Tmax Soft JEUS 5 Fix#26 is not vulnerable. The vendor informs that users upgrade to this version(Fix #26).

Please change this information.

Sincerely, Simon

---------- Forwarded message ---------- From: Simon Ryeo <bar4mi@gmail.com> Date: 2008/12/13 Subject: TmaxSoft JEUS Alternate Data Streams Vulnerability To: bugtraq@securityfocus.com

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Title: TmaxSoft JEUS Alternate Data Streams Vulnerability Author: Simon Ryeo(bar4mi (at) gmail) Severity: High Impact: Remote File Disclosure Vulnerable Version: < JEUS 5: Fix#26 on NTFS References: - http://www.microsoft.com/technet/security/bulletin/ms98-003.mspx - http://www.tmaxsoft.com - http://www.tmax.co.kr/tmaxsoft/index.screen History: - 10.22.2008: Initiate notify - 10.23.2008: The vendor responded - 11.21.2008: The vendor replied detail information. - 12.12.2008: The vendor finished the preparation for patches and responses.

Description: On NTFS TmaxSoft JEUS, which is an famous web application server, contained a vulnerability that allows an attacker to obtain web application source files. This was caused by ADSs(Alternate Data Streams; ::$DATA). JEUS couldn't handle ::$DATA. So it treated test.jsp::$DATA as an normal file when it requested. This is similar to the past MS Widnows IIS vulnerability(Bid 0149).

Exploit: The attacker can obtain them easily using an URL request. http://www.target.com/foo/bar.jsp::$DATA

Solution: The vendor released solutions for this problem. Method 1) Upgrade JEUS - JEUS 5: http://technet.tmax.co.kr/kr/download/platformList.do?groupCode=WAS&product Code=Jeus&versionCode=5.0.0.26.P&fc=down&sc=down_product&mid=binary - JEUS 4: a. Use to change WebtoB function b. Upgrade JEUS to version 6 (the service for version 4 will be out of service after Dec 2009) Method 2) Use to change WebtoB fuction - Change the message communication method from 'URI' to 'EXT' (This is valid whether you use the embed WebtoB to JEUS or the single WebtoB) Method 3) Install the patch (ex. jext.jar) - The patch file will be valid until Jan. 2009 (Target version: 3.3.7.15, 4.0, 4.1, 4.2 final, 5.x(each verison will be offered below Fix#26)

Please refer to TmaxSoft Homepage for detail support palns. It will be valid until Mar. 2009. (http://www.tmaxsoft.com)

-----BEGIN PGP SIGNATURE----- Version: 9.8.3.4028

wj8DBQFJQqOXzuoR/xLtCioRAn2DAKDpN2ckXu7xt6OvYUeWHLiEoPQOmwCg6csI KY69SPNXHg2rHlXJanIBQDw= =SW3P -----END PGP SIGNATURE------