IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability

Bugtraq ID:	16908
Class:	Input Validation Error
CVE:	CVE-2006-1093
Remote:	Yes
Local:	No
Published:	Mar 01 2006 12:00AM
Updated:	Jun 27 2007 09:08PM
Credit:	This issue was reported by IBM.
Vulnerable:	IBM Websphere Application Server 5.1.1 .9 IBM Websphere Application Server 5.1.1 .8 IBM Websphere Application Server 5.1.1 .7 IBM Websphere Application Server 5.1.1 .6 IBM Websphere Application Server 5.1.1 .5 IBM Websphere Application Server 5.1.1 .4 IBM Websphere Application Server 5.0.2 .15 IBM Websphere Application Server 5.0.2 .14 IBM Websphere Application Server 5.0.2 .13 IBM Websphere Application Server 5.0.2 .12 IBM Websphere Application Server 5.0.2 .11 IBM Websphere Application Server 5.0.2 .10
Not Vulnerable:	IBM Websphere Application Server 6.0.2 IBM Websphere Application Server 5.1.1 .10 IBM Websphere Application Server 5.0.2 .16

IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability

IBM WebSphere Application Server is prone to a sourcecode-disclosure vulnerability. An attacker can exploit this issue by supplying malformed HTTP requests to the server to disclose JSP sourcecode.

This issue allows remote attackers to gain access to the contents of potentially sensitive JSP source pages, aiding them in further attacks.

IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability

An attacker likely utilizes a web browser to exploit this issue.

IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability

Solution:
IBM has released fixes and an advisory to address this issue. Please see the referenced advisory for information on obtaining fixes.

IBM WebSphere Application Server JSP Source Code Disclosure Vulnerability

References:

• Recommended fixes for WebSphere Application Server (IBM)
  
• Security: Possible security exposure with JSP source code on IBM WebSphere Appli (IBM)
  
• WebSphere Product Page (IBM)