Macromedia JRun Log File/JRun.INI File Disclosure Vulnerability

Bugtraq ID:	6125
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 07 2002 12:00AM
Updated:	Nov 07 2002 12:00AM
Credit:	This issue was reported in a Macromedia security alert.
Vulnerable:	Macromedia JRun 4.0 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Macromedia JRun 3.1 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Redhat Linux 6.1 sparc - Redhat Linux 6.1 i386 - Redhat Linux 6.1 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 alpha - Redhat Linux 6.0 - SGI IRIX 6.5 - Sun Solaris 8_sparc - Sun Solaris 7.0 Macromedia JRun 3.0 - IBM AIX 4.3 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Redhat Linux 6.1 sparc - Redhat Linux 6.1 i386 - Redhat Linux 6.1 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 - SGI IRIX 6.5 - Sun Solaris 7.0 - Sun Solaris 2.6
Not Vulnerable:	Macromedia JRun 4.0 SP1a Macromedia JRun 4.0 SP1

Macromedia JRun Log File/JRun.INI File Disclosure Vulnerability

Macromedia JRun is prone to a file disclosure vulnerability.

It has been reported that this issue may be exploited by remote attackers to retrieve sensitive resources such as JRun log files or the 'jrun.ini' configuration file.

Disclosure of this type of sensitive information may lead to further attacks against the vulnerable host.

This issue is specific to JRun running on Microsoft Windows platforms.

Macromedia JRun Log File/JRun.INI File Disclosure Vulnerability

This issue may be exploited with a web browser.

Macromedia JRun Log File/JRun.INI File Disclosure Vulnerability

Solution:
Macromedia has released patches to address this issue.


Macromedia JRun 3.0

• Macromedia JRun 3.0 Windows Upgrade 53843
  Fixes are available for internationalized versions of JRun.
  http://www.macromedia.com/v1/handlers/index.cfm?ID=23500

Macromedia JRun 3.1

• Macromedia JRun 3.1 Windows Upgrade 54009
  Fixes are available for internationalized versions of JRun.
  http://www.macromedia.com/v1/handlers/index.cfm?ID=23500

Macromedia JRun 4.0

• Macromedia JRun 4.0 Windows Upgrade SP1
  Fixes are available for internationalized versions of JRun.
  http://www.macromedia.com/v1/handlers/index.cfm?ID=23500

Macromedia JRun Log File/JRun.INI File Disclosure Vulnerability

References:

• MPSB02-12 - Cumulative Security Patch available for JRun 3.0, 3.1 and 4.0 (Macromedia)