Fujitsu-Siemens WebTransactions Unspecified Remote Command Execution Vulnerability

Bugtraq ID:	32927
Class:	Input Validation Error
CVE:	CVE-2008-5810
Remote:	Yes
Local:	No
Published:	Dec 19 2008 12:00AM
Updated:	Jan 05 2009 10:42PM
Credit:	An anonymous source at SEC Consult
Vulnerable:	Fujitsu-Siemens WebTransactions 7.1 Fujitsu-Siemens WebTransactions 7.0 Fujitsu-Siemens WebTransactions 6.0
Not Vulnerable:

Fujitsu-Siemens WebTransactions Unspecified Remote Command Execution Vulnerability

Fujitsu-Siemens WebTransactions is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

WebTransactions 6.0, 7.0, and 7.1 are vulnerable; other versions may also be affected.

Fujitsu-Siemens WebTransactions Unspecified Remote Command Execution Vulnerability

This issue can be exploited via a browser.

Fujitsu-Siemens WebTransactions Unspecified Remote Command Execution Vulnerability

Solution:
Updates are available; please see the references for more information.


Fujitsu-Siemens WebTransactions 7.0

• Fujitsu-Siemens wtPatch70linux.tar.gz
  for Linux
  http://bs2www.fujitsu-siemens.de/update/wtPatch70linux.tar.gz


• Fujitsu-Siemens wtPatch70solaris.tar.gz
  for Solaris
  http://bs2www.fujitsu-siemens.de/update/wtPatch70solaris.tar.gz


• Fujitsu-Siemens wtPatch70windows.zip
  for Windows
  http://bs2www.fujitsu-siemens.de/update/wtPatch70windows.zip

Fujitsu-Siemens WebTransactions 7.1

• Fujitsu-Siemens wtPatch71linux.tar.gz
  for Linux
  http://bs2www.fujitsu-siemens.de/update/wtPatch71linux.tar.gz


• Fujitsu-Siemens wtPatch71solaris.tar.gz
  for Solaris
  http://bs2www.fujitsu-siemens.de/update/wtPatch71solaris.tar.gz


• Fujitsu-Siemens wtPatch71windows.zip
  for Windows
  http://bs2www.fujitsu-siemens.de/update/wtPatch71windows.zip

Fujitsu-Siemens WebTransactions Unspecified Remote Command Execution Vulnerability

References:

• Fujitsu-Siemens Homepage (Fujitsu-Siemens)
  
• In WebTransactions a critical security vulnerability was detected by SEC Consult (Fujitsu-Siemens)
  
• SEC Consult SA-20081219-0 :: Fujitsu-Siemens WebTransactions remote command inje (Bernhard Mueller )