CIA RESEARCH

Alerts

[CIA-1072-Alert] IBM WebSphere Application Server Input Validation Vulnerability

Summary:

An input validation vulnerabiiity in the IBM WebSphere Application Server versions 6.X allows an attacker to conduct Cross-Site Scripting (XSS) attacks.

Technical Details:

6.X versions of the IBM WebSphere Application Server fail to properly sanitize special characters when responding to a specially crafted HTTP request. The server response will preserve the characters within the original request in a manner that permits their execution. Affected sites should apply APAR PK16602 to eliminate the vulnerability. On unpatched systems an attacker may be able to attack legitimate users of the server by redirecting those users to arbitrary websites, steal user cookies, or otherwise exploit browser flaws.

Solution:

Apply IBM APAR PK16602, available from the IBM support website.

CVE Reference:

CVE-2006-2431

SecurityTracker Number(s):

1017170

Vendor URL:

IBM

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm^® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC