| Title | Hitachi Web Server における複数の脆弱性 |
|---|---|
| Summary | Hitachi Web Server には下記の脆弱性が存在します。 1. SSL を使用している場合に、OpenSSL のバージョンをロールバックされる脆弱性があります。 2. Hitachi Web Server が自動作成したコンテンツにクロスサイトスクリプティングの脆弱性があります。 3. Expect ヘッダの処理に不備があるため、クロスサイトスクリプティングの脆弱性があります。 |
| Possible impacts | 1. SSLを使用している場合、攻撃者により、不当にSSLバージョン2の接続に変更される可能性があります。 2,3. 不正なスクリプトを挿入される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | Dec. 21, 2006, midnight |
| Registration Date | Feb. 2, 2009, 3:46 p.m. |
| Last Update | May 22, 2014, 5:59 p.m. |
| CVSS2.0 : 警告 | |
| Score | 5 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| 日立 |
| Cosminexus Application Server Enterprise Version 6 |
| Cosminexus Application Server Standard Version 6 |
| Cosminexus Application Server Version 5 |
| Cosminexus Developer Light Version 6 |
| Cosminexus Developer Professional Version 6 |
| Cosminexus Developer Standard Version 6 |
| Cosminexus Developer Version 5 |
| Cosminexus Server - Enterprise Edition |
| Cosminexus Server - Standard Edition |
| Cosminexus Server - Standard Edition Version 4 |
| Cosminexus Server - Web Edition |
| Cosminexus Server - Web Edition Version 4 |
| Hitachi Web Server |
| Hitachi Web Server - Custom Edition |
| Hitachi Web Server - Security Enhancement |
| Hitachi Web Server for VOS3 |
| uCosminexus Application Server Enterprise |
| uCosminexus Application Server Smart Edition |
| uCosminexus Application Server Standard |
| uCosminexus Developer Professional |
| uCosminexus Developer Light |
| uCosminexus Developer Standard |
| uCosminexus Service Architect |
| uCosminexus Service Platform |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2009年02月02日] 掲載 [2014年05月22日] 参考情報：Common Vulnerabilities and Exposures (CVE) (CVE-2005-2969) を追加 参考情報：Common Vulnerabilities and Exposures (CVE) (CVE-2006-3918) を追加 参考情報：Common Vulnerabilities and Exposures (CVE) (CVE-2005-3352) を追加 参考情報：Common Vulnerabilities and Exposures (CVE) (CVE-2007-0514) を追加 参考情報：National Vulnerability Database (NVD) (CVE-2005-2969) を追加 参考情報：National Vulnerability Database (NVD) (CVE-2006-3918) を追加 参考情報：National Vulnerability Database (NVD) (CVE-2005-3352) を追加 参考情報：National Vulnerability Database (NVD) (CVE-2007-0514) を追加 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack. |
|---|---|
| Publication Date | Oct. 19, 2005, 6:02 a.m. |
| Registration Date | Jan. 29, 2021, 5:59 p.m. |
| Last Update | May 3, 2018, 10:29 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:* | |||||
| Summary | Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps. |
|---|---|
| Publication Date | Dec. 14, 2005, 5:03 a.m. |
| Registration Date | Jan. 29, 2021, 5:59 p.m. |
| Last Update | Jan. 20, 2024, 12:12 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 1.3.35 | ||||
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.0 | 2.0.56 | |||
| Summary | http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file. |
|---|---|
| Publication Date | July 28, 2006, 9:04 a.m. |
| Registration Date | Jan. 29, 2021, 3:42 p.m. |
| Last Update | Nov. 7, 2023, 10:59 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 1.3.3 | 1.3.35 | |||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:* | |||||
| Summary | Multiple cross-site scripting (XSS) vulnerabilities in multiple Hitachi Web Server, uCosminexus, and Cosminexus products before 20070124 allow remote attackers to inject arbitrary web script or HTML via (1) HTTP Expect headers or (2) image maps. |
|---|---|
| Publication Date | Jan. 26, 2007, 9:28 a.m. |
| Registration Date | Jan. 29, 2021, 2:05 p.m. |
| Last Update | March 8, 2011, 11:49 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:hitachi:cosminexus_application_server:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_application_server:6:*:enterprise:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_application_server_version_5:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_developer_light_version_6:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_developer_professional_version_6:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_developer_standard_version_6:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_developer_version_5:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_server_-_enterprise_edition:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_server_-_standard_edition:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_server_-_standard_edition_version_4:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_server_-_web_edition:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:cosminexus_server_-_web_edition_version_4:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:hitachi_web_server:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_application_server_enterprise:*:*:enterprise:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_application_server_smart_edition:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_application_server_standard:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_developer_light:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_developer_standard:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_service_architect:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:hitachi:ucosminexus_service_platform:*:*:*:*:*:*:*:* | |||||