Tmax Soft JEUS Alternate Data Stream 源代码信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117012 漏洞类型 输入验证
发布时间 2008-12-12 更新时间 2009-03-26
CVE编号 CVE-2008-6528 CNNVD-ID CNNVD-200903-453
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/7442
https://cxsecurity.com/issue/WLB-2008120034
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-453
|漏洞详情
NTFSTmaxSoftJEUS5Fix26之前的版本允许远程攻击者通过对URL添加::$DATA,读取源代码。它可以访问替换数据流。
|漏洞EXP
Title: TmaxSoft JEUS Alternate Data Streams Vulnerability
Author: Simon Ryeo(bar4mi (at) gmail)
Severity: High
Impact: Remote File Disclosure
Vulnerable Version: < JEUS 5: Fix#26 on NTFS
References:
 - http://www.microsoft.com/technet/security/bulletin/ms98-003.mspx
 - http://www.tmaxsoft.com
 - http://www.tmax.co.kr/tmaxsoft/index.screen
History:
 - 10.22.2008: Initiate notify
 - 10.23.2008: The vendor responded
 - 11.21.2008: The vendor replied detail information.
 - 12.12.2008: The vendor finished the preparation for patches and
responses.

Description:
On NTFS TmaxSoft JEUS, which is an famous web application server, contained
a vulnerability that allows an attacker to obtain web application source
files. This was caused by ADSs(Alternate Data Streams; ::$DATA).
JEUS couldn't handle ::$DATA. So it treated test.jsp::$DATA as an normal
file when it requested.
This is similar to the past MS Windows IIS vulnerability(Bid 0149).

Exploit:
The attacker can obtain them easily using an URL request.
http://www.target.com/foo/bar.jsp::$DATA

Solution:
The vendor released solutions for this problem.
Method 1) Upgrade JEUS
 - JEUS 5:
http://technet.tmax.co.kr/kr/download/platformList.do?groupCode=WAS&product
Code=Jeus&versionCode=5.0.0.26.P&fc=down&sc=down_product&mid=binary
 - JEUS 4:
    a. Use to change WebtoB function
    b. Upgrade JEUS to version 6 (the service for version 4 will be out of
service after Dec 2009)
Method 2) Use to change WebtoB fuction
 - Change the message communication method from 'URI' to 'EXT'
   (This is valid whether you use the embed WebtoB to JEUS or the single
WebtoB)
Method 3) Install the patch (ex. jext.jar)
 - The patch file will be valid until Jan. 2009
   (Target version: 3.3.7.15, 4.0, 4.1, 4.2 final, 5.x(each verison will be
offered below Fix#26)

Please refer to TmaxSoft Homepage for detail support palns. It will be
valid until Mar. 2009.
(http://www.tmaxsoft.com)

# milw0rm.com [2008-12-12]
|参考资料

来源:XF
名称:jeus-ads-file-disclosure(47303)
链接:http://xforce.iss.net/xforce/xfdb/47303
来源:BID
名称:32804
链接:http://www.securityfocus.com/bid/32804
来源:BUGTRAQ
名称:20081214Fwd:TmaxSoftJEUSAlternateDataStreamsVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/499236/100/0/threaded
来源:BUGTRAQ
名称:20081212TmaxSoftJEUSAlternateDataStreamsVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/499235/100/0/threaded
来源:MILW0RM
名称:7442
链接:http://www.milw0rm.com/exploits/7442
来源:SECUNIA
名称:33123
链接:http://secunia.com/advisories/33123