JRun Multiple Vulnerabilities (OF, XSS, ID, Hijacking)

Medium Nessus Plugin ID 14810

Synopsis

The remote web application server is affected by multiple flaws.

Description

The remote host is running JRun, a J2EE application server running on top of IIS or Apache. There are multiple flaws in the remote version of this software :

- The JSESSIONID variable is not implemented securely. An attacker may use this flaw to guess the session id number of other users. Only JRun 4.0 is affected.

- There is a code disclosure issue that may allow an attacker to obtain the contents of a .cfm file by appending ';.cfm' to the file name.
Only the Microsoft IIS connector and JRun 4.0 are affected.

- There is a buffer overflow vulnerability if the server connector is configured in 'verbose' mode. An attacker may exploit this flaw to execute arbitrary code on the remote host.

Solution

Apply the appropriate patch / updater referenced in the vendor advisories above.

See Also

http://www.acrossecurity.com/papers/session_fixation.pdf

http://www.nessus.org/u?10a5f865

http://www.nessus.org/u?60f8f589

http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.html

http://www.macromedia.com/devnet/security/security_zone/mpsb04-09.html

Plugin Details

Severity: Medium

ID: 14810

File Name: jrun_multiple_flaws.nasl

Version: 1.22

Type: remote

Family: Web Servers

Published: 2004/09/24

Updated: 2018/07/12

Dependencies: 10107, 11919, 67257, 17975

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5.1

Temporal Score: 3.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2004/09/23

Vulnerability Publication Date: 2004/09/23

Reference Information

CVE: CVE-2004-0646, CVE-2004-0928, CVE-2004-1477, CVE-2004-1478, CVE-2004-2182

BID: 11245, 11331, 11411, 11413, 11414

CWE: 287