A vulnerability to Denial of Service (DoS) attacks was found in Cosminexus XML Processor.
Malicious remote users might exploit this vulnerability to disrupt services.
Vulnerability ID

HS09-017
Vulnerability description

When Cosminexus XML Processor, which is a component product of the following products, receives invalid XML data as a SOAP message, services are disrupted.

- Cosminexus V7 and V8

    * uCosminexus Application Server Enterprise
    * uCosminexus Application Server Standard
    * uCosminexus Service Platform
    * uCosminexus Developer Standard
    * uCosminexus Developer Professional
    * uCosminexus Service Architect
    * uCosminexus Operator
    * uCosminexus Client
    * uCosminexus Navigation Platform(*1)
    * uCosminexus Navigation Platform - User License(*1)
    * uCosminexus Navigation Platform - Authoring License(*1)
    * uCosminexus Navigation Developer(*1)

Affected products and versions are listed below. Please upgrade your version to the appropriate version.

*1
    uCosminexus Application Server Standard and/or uCosminexus Developer Professional contained in these products are affected.

Affected products

The information is organized under the following headings:
(Example)
Product name: Gives the name of the affected product.

Version:

Platform
    Gives the affected version.

- Cosminexus V8
Product name: uCosminexus Application Server Enterprise
Product name: uCosminexus Application Server Standard

Version(s):

Windows
    08-00 to 08-00-04
Linux
    08-00 to 08-00-01
Linux(IPF)
    08-00
AIX
    08-00 to 08-00-01
HP-UX(IPF)
    08-00
Solaris
    08-00

Product name: uCosminexus Service Platform

Version(s):

Windows
    08-00 to 08-00-04, 08-10
Linux
    08-00 to 08-00-01, 08-10
Linux(IPF)
    08-00, 08-10
AIX
    08-00, 08-10
HP-UX(IPF)
    08-00, 08-10

Product name: uCosminexus Developer Standard
Product name: uCosminexus Developer Professional
Product name: uCosminexus Client

Version(s):

Windows
    08-00 to 08-00-04

Product name: uCosminexus Service Architect

Version(s):

Windows
    08-00 to 08-00-04, 08-10

Product name: uCosminexus Navigation Platform
Product name: uCosminexus Navigation Platform - User License
Product name: uCosminexus Navigation Platform - Authoring License
Product name: uCosminexus Navigation Developer

Version(s):

Windows
    08-00, 08-01

- Cosminexus V7
Product name: uCosminexus Application Server Enterprise
Product name: uCosminexus Application Server Standard

Version(s):

Windows
    07-00 to 07-00-03, 07-10 to 07-10-01, 07-20 to 07-20-01
Linux
    07-00 to 07-00-01, 07-10
Linux(IPF)
    07-10 to 07-10-01
AIX
    07-00, 07-10
HP-UX
    07-10
HP-UX(IPF)
    07-00, 07-10 to 07-10-01
Solaris
    07-00

Product name: uCosminexus Service Platform

Version(s):

Windows
    07-00 to 07-00-03, 07-10 to 07-10-01, 07-20 to 07-20-01
Linux
    07-00, 07-10
AIX
    07-10

Product name: uCosminexus Developer Standard
Product name: uCosminexus Developer Professional
Product name: uCosminexus Service Architect
Product name: uCosminexus Client

Version(s):

Windows
    07-00 to 07-00-03, 07-10 to 07-10-01, 07-20 to 07-20-01

Product name: uCosminexus Operator

Version(s):

Windows
    07-00 to 07-00-03, 07-10 to 07-10-01, 07-20

Fixed products

The information is organized under the following headings:
(Example)
Product name: Gives the name of the fixed product.

Version:

Platform
    Gives the fixed version, and release date.

Scheduled version(s):

Platform
    Gives the fixed version scheduled to be released.

- Cosminexus V8
Product name: uCosminexus Application Server Enterprise
Product name: uCosminexus Application Server Standard
Product name: uCosminexus Service Platform
Product name: uCosminexus Developer Standard
Product name: uCosminexus Developer Professional
Product name: uCosminexus Service Architect
Product name: uCosminexus Client

Fixed component product name(*2):

    * Cosminexus XML Processor

Fixed component product version(s)(*2):

Windows
    08-00-02 September 7, 2009
Linux
    08-00-02 August 7, 2009

Scheduled version(s):

Linux(IPF)
    08-00-01
AIX
    08-00-01
HP-UX(IPF)
    08-00-01
Solaris
    08-00-01

Product name: uCosminexus Navigation Platform
Product name: uCosminexus Navigation Platform - User License
Product name: uCosminexus Navigation Platform - Authoring License
Product name: uCosminexus Navigation Developer

Scheduled version(s):

Windows
    08-10

- Cosminexus V7
Product name: uCosminexus Application Server Enterprise
Product name: uCosminexus Application Server Standard
Product name: uCosminexus Service Platform
Product name: uCosminexus Developer Standard
Product name: uCosminexus Developer Professional
Product name: uCosminexus Service Architect
Product name: uCosminexus Operator
Product name: uCosminexus Client

Fixed component product name(*2):

    * Cosminexus XML Processor

Fixed component product version(s)(*2):

Windows
    07-00-03 October 15, 2007
Linux
    07-00-02 October 15, 2007
Linux(IPF)
    07-00-01 October 15, 2007
AIX
    07-00-01 October 15, 2007
HP-UX
    07-00-01 October 15, 2007
HP-UX(IPF)
    07-00-01 October 15, 2007
Solaris
    07-00-02 October 15, 2007

For details on the fixed products, contact your Hitachi support service representative.

*2
    Cosminexus XML Processor, which is a component product, has been fixed. Apply the fixed version of the component product.