----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
IBM WebSphere Application Server Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA32296

VERIFY ADVISORY:
http://secunia.com/advisories/32296/

CRITICAL:
Moderately critical

IMPACT:
Unknown, Security Bypass, DoS

WHERE:
>From remote

SOFTWARE:
IBM WebSphere Application Server 6.0.x
http://secunia.com/advisories/product/4651/

DESCRIPTION:
Some vulnerabilities and a security issue have been reported in IBM
WebSphere Application Server. One vulnerability has an unknown
impact, the others can be exploited by malicious people to cause a
DoS (Denial of Service) or bypass certain security restrictions.

1) A vulnerability is caused due to an unspecified error when the
"fileServing" feature is enabled.

This is related to:
SA31892

2) An error in the processing of HTTP requests can be exploited to
cause an "0C4" abend in the controller via a specially crafted
request containing an overly long HTTP "Host" header (more than 256
bytes), and may hang the server.

3) A security issue is caused due to Web services security not
properly processing Certificate Revocation Lists (CRL). This can lead
to revoked X509 certificates not being rejected by the system.

SOLUTION:
IBM WebSphere Application Server 6.0.x:
Apply Fix Pack 31 (6.0.2.31).

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
IBM (PK64302, PK69371, PK61258):
http://www-01.ibm.com/support/docview.wss?uid=swg27006876

OTHER REFERENCES:
SA31892:
http://secunia.com/advisories/31892/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------