Tmax Soft JEUS Alternate Data Stream Source Code Information Disclosure Vulnerability

Bugtraq ID:	32804
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 12 2008 12:00AM
Updated:	Dec 18 2008 05:11PM
Credit:	Simon Ryeo(bar4mi (at) gmail)
Vulnerable:	Tmax Soft JEUS 3.3.7 .15 Tmax Soft JEUS 3.2.2 Tmax Soft JEUS 3.1.4 p1 Tmax Soft JEUS 5 Tmax Soft JEUS 4.2 final Tmax Soft JEUS 4.1 Tmax Soft JEUS 4.0
Not Vulnerable:	Tmax Soft JEUS 6 Tmax Soft JEUS 5 Fix#26

Tmax Soft JEUS Alternate Data Stream Source Code Information Disclosure Vulnerability

Tmax Soft JEUS is prone to a vulnerability that allows attackers to access source code because the application fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable computer in the context of the webserver process. Information obtained may aid in further attacks.

Versions prior to JEUS 6 are vulnerable.

Tmax Soft JEUS Alternate Data Stream Source Code Information Disclosure Vulnerability

Attackers can exploit this vulnerability via a browser.

The following example URI is available:

http://www.example.com/foo/bar.jsp::$DATA

Tmax Soft JEUS Alternate Data Stream Source Code Information Disclosure Vulnerability

Solution:
The vendor has released fixes to address this issue. Please contact the vendor for details.

Tmax Soft JEUS Alternate Data Stream Source Code Information Disclosure Vulnerability

References:

• Vendor Homepage (Tmax Soft)