BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
BID:8931
Info
BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
| Bugtraq ID: | 8931 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0621 CVE-2003-0622 CVE-2003-0623 |
| Remote: | No |
| Local: | No |
| Published: | Oct 30 2003 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | The disclosure of this issue has been credited to Corsaire Limited. |
| Vulnerable: |
BEA Systems WebLogic Enterprise 5.1 BEA Systems WebLogic Enterprise 5.0.1 BEA Systems WebLogic Enterprise 4.2 BEA Systems Tuxedo 8.1 BEA Systems Tuxedo 8.0 BEA Systems Tuxedo 7.1 BEA Systems Tuxedo 6.5 BEA Systems Tuxedo 6.4 BEA Systems Tuxedo 6.3 |
| Not Vulnerable: | |
Discussion
BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
A vulnerability has reported to exist in BEA Tuxedo and WebLogic Enterprise due to Tuxedo administration console. The script is reported to accept various initialization arguments such as INIFILE that are not properly sanitized for user-supplied input. This issue may allow an attacker to carry out attacks such as denial of service, file disclosure, and cross-site scripting.
An attacker may be able to determine the existence of a file outside the web server root by supplying passing various path values for INIFILE.
A denial of service condition could be caused in the software by providing a device name such as CON, AUX, COM1, COM2 instead of a valid file name as one of the arguments for INIFILE. This may cause the service to crash or hang.
A cross-site scripting vulnerability has also been reported to exist in the software due to insufficient santization of user-supplied input to INIFILE. This problem presents itself when an invalid file name is supplied as an argument for INIFILE. This vulnerability could be exploited to steal cookie-based credentials. Other attacks are possible as well.
A vulnerability has reported to exist in BEA Tuxedo and WebLogic Enterprise due to Tuxedo administration console. The script is reported to accept various initialization arguments such as INIFILE that are not properly sanitized for user-supplied input. This issue may allow an attacker to carry out attacks such as denial of service, file disclosure, and cross-site scripting.
An attacker may be able to determine the existence of a file outside the web server root by supplying passing various path values for INIFILE.
A denial of service condition could be caused in the software by providing a device name such as CON, AUX, COM1, COM2 instead of a valid file name as one of the arguments for INIFILE. This may cause the service to crash or hang.
A cross-site scripting vulnerability has also been reported to exist in the software due to insufficient santization of user-supplied input to INIFILE. This problem presents itself when an invalid file name is supplied as an argument for INIFILE. This vulnerability could be exploited to steal cookie-based credentials. Other attacks are possible as well.
Exploit / POC
BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
The following proof of concept has been provided:
http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script>
The following proof of concept has been provided:
http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script>
Solution / Fix
BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
Solution:
The vendor has released fixes to address this issue. Please see the referenced advisory (BEA03-38.00) for more information.
For Tuxedo 8.1:
Apply Rolling Patch 62 or later.
For all other releases:
pgrade to Tuxedo 8.1 or Contact BEA Customer Support to request a fix for the
release you are using.
Solution:
The vendor has released fixes to address this issue. Please see the referenced advisory (BEA03-38.00) for more information.
For Tuxedo 8.1:
Apply Rolling Patch 62 or later.
For all other releases:
pgrade to Tuxedo 8.1 or Contact BEA Customer Support to request a fix for the
release you are using.
References
BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerability
References:
References:
- SECURITY ADVISORY (BEA03-38.00) (BEA Systems)
- Tuxed Product Homepage (BEA Systems)
- WebLogic Server Product Homepage (Oracle)