what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

STG-Jeus-Eng.txt

STG-Jeus-Eng.txt
Posted Jun 21, 2003
Authored by STG Security | Site stgsecurity.com

STG Security Advisory - Java Enterprise User Solution, or JEUS, has a cross site scripting vulnerability issue when invoking non-existent URLs.

tags | exploit, java, xss
SHA-256 | fb61d2e5a250f0d0de9f36ee16d044503666f5e77723563ef05e9844f37d058c

STG-Jeus-Eng.txt

Change Mirror Download
STG Security Advisory: JEUS Web Application Server Cross Site Scripting Vulnerability

Revision: 1.1
Date Published: 2003-06-17 (KST)
Last Update: 2003-06-17

Product Description
=========
JEUS (Java Enterprise User Solution) is a J2EE compatible web application server, developed by Tmax Soft, providing a clustering system especially designed for large enterprise business applications.

Vulnerability Class
================
Implementation Error: Inappropriate Input Validation

Afftected Products
================
This vulnerability was found at JEUS 3.1.4p1. The vendor confirmed all versions below 3.2.2 have this vulnerability.

Details
======
JEUS Web Application Server Error Page has a cross site scripting vulnerability issue when Invoking non-exists URL like below.

Proof of Concept
http://vulnerable.com/url.jsp?foo=<script>alert('XSS vulerability exists!')</script>

An attacker could hijack the session of an administrator or spread viruses or worms using vulnerabilities of Web browsers.

Impact
======
At August 2002, Eye on Security released an article entitled "Bypassing JavaScript Filters - the Flash! Attack" on the attacking method utilizing cross site scripting vulnerabilities. A highly effective automated tool using this method for session hijacking in the wild enables an attacker to aquire the privilege of administrators and to alter or erase the web page of an victim site.

Solutions
========
STG Security has notified this vulnerability to the vendor, which fixed this problem and released JEUS 3.2.2 on October 2002.
More detail information is found at http://www.tmax.co.kr

Vendor Status: FIXED
===================
2002-10-12 Tmax Soft notified.
2002-10-17 Second attempt at vendor contact.
2002-10-17 Fixed version released.
2003-05-21 Last attempt at vendor contact.
2003-05-23 Public disclosure.



Credits
======
Jeremy Bae at STG Security SSR Team

About STG Security
=================
STG Security Inc. is a affiliated company of STG Group which has its head office in the States founded in march 2000. Its core business area is Information Security Consulting Service based on 30 years of various Information Security Consulting experiences in the States including more than 100 projects of Risk Assessment and Penetration testing implemented for the American government organizations. Also STG Group is a member company to undertake Safeguard project which is government Information Security project initiated by the Clinton cabinet. Those experiences and methodologies are applied to the Korean Information Security market by STG Security Inc.

http://www.stgsecurity.com/

Phone +82-2-6333-4500
FAX +82-2-6333-4545
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close