IBM WebSphere Application Server 'mod_ibm_ssl' HTTP Request Remote Denial Of Service Vulnerability

Bugtraq ID:	41081
Class:	Design Error
CVE:	CVE-2010-2327
Remote:	Yes
Local:	No
Published:	Jun 09 2010 12:00AM
Updated:	Mar 19 2015 09:22AM
Credit:	IBM
Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 7.0 .9 IBM Websphere Application Server 7.0 .8 IBM Websphere Application Server 6.1.2 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .32 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 6.0.2 .9 IBM Websphere Application Server 6.0.2 .7 IBM Websphere Application Server 6.0.2 .5 IBM Websphere Application Server 6.0.2 .39 IBM Websphere Application Server 6.0.2 .35 IBM Websphere Application Server 6.0.2 .33 IBM Websphere Application Server 6.0.2 .31 IBM Websphere Application Server 6.0.2 .3 IBM Websphere Application Server 6.0.2 .29 IBM Websphere Application Server 6.0.2 .27 IBM Websphere Application Server 6.0.2 .25 IBM Websphere Application Server 6.0.2 .24 IBM Websphere Application Server 6.0.2 .23 IBM Websphere Application Server 6.0.2 .22 IBM Websphere Application Server 6.0.2 .21 IBM Websphere Application Server 6.0.2 .17 IBM Websphere Application Server 6.0.2 .15 IBM Websphere Application Server 6.0.2 .13 IBM Websphere Application Server 6.0.2 .11 IBM Websphere Application Server 6.0.2 .1 IBM Websphere Application Server 6.0.2 IBM Websphere Application Server 6.0.1 IBM Websphere Application Server 6.0 .7 IBM Websphere Application Server 6.0 IBM Websphere Application Server 7.0.0.7 IBM Websphere Application Server 7.0.0.5 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1.0.31 IBM Websphere Application Server 6.1.0.29 IBM Websphere Application Server 6.1.0.27 IBM Websphere Application Server 6.0.2.41 IBM Websphere Application Server 6.0.2.19 IBM Websphere Application Server 6.0.2 Fix Pack 17
Not Vulnerable:	IBM Websphere Application Server 7.0 .11 IBM Websphere Application Server 6.1.0.33 IBM Websphere Application Server 6.0.2.43

IBM WebSphere Application Server 'mod_ibm_ssl' HTTP Request Remote Denial Of Service Vulnerability

IBM WebSphere Application Server (WAS) for z/OS is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause the application to crash, denying service to legitimate users.

Versions prior to WAS 6.0.2.43, 6.1.0.33, and 7.0.0.11 are vulnerable.

IBM WebSphere Application Server 'mod_ibm_ssl' HTTP Request Remote Denial Of Service Vulnerability

Attackers can use readily available tools to exploit this issue.

IBM WebSphere Application Server 'mod_ibm_ssl' HTTP Request Remote Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for details.

IBM WebSphere Application Server 'mod_ibm_ssl' HTTP Request Remote Denial Of Service Vulnerability

References:

• IBM WebSphere Application Server Product Page (IBM)
  
• M15830: SHIP APAR FIXES FOR H28W700 FIX PACK 7.0.0.11. (IBM)
  
• PM10270: THE IBM HTTP SERVER CAN FAIL DURING AN UPLOAD THAT IS GREATER THAN 2 GB (IBM)