[22749] in bugtraq
JRun 3.0 SP2 Vulnerability??
daemon@ATHENA.MIT.EDU (Kerry Steele)
Thu Sep 27 18:14:50 2001
From: "Kerry Steele" <steele_kerry@hotmail.com>
To: bugtraq@securityfocus.com
Date: Thu, 27 Sep 2001 16:53:13 -0500
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F29iz2Mb1s7nlT2NqFJ000085ad@hotmail.com>
Scenario:
Windows 2000 Advanced Server SP2 running IIS.
Fully patched server, including Q301625 - the cumulative IIS patch.
Locked down using the Microsoft IIS Lockdown Tool.
Locked down using the HISECWEB security template.
Locked down using the Securing IIS 5.0 Checklist.
Should not be vulnerable to Code Red or Nimda, etc. - one would think.
Now load Allaire JRun 3.0 Professional Edition with SP2.
Is it possible that this machine was infected with the Nimda virus, as the
JRun ISAPI extension interprets all requests sent to the server? An attempt
was left in the event log where the Windows Protection Service prevented
overwriting the cmd.exe file (least it's good for something) - therefore I
have to assume that it's been compromised.
Are there any Directory Traversal, Unicode, etc. vulnerabilities for JRun
3.0 SP2 that I am missing? If not, is JRun vulnerable to the Nimda worm?
Does not make sense, this server was FULLY patched.
Example of a vulnerability where IIS was patched, but JRun was still
vulnerable:
http://www.allaire.com/handlers/index.cfm?ID=21759&Method=Full
~~~~~~~~~~~~
Kerry Steele
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
