ID

VAR-201104-0325

TITLE

Hitachi Web Server 'RequestHeader' Directive Information Disclosure Vulnerability

DESCRIPTION

Hitachi Web Server is a web server on Hitachi products. The Hitachi Web Server SSL protocol has errors and can be injected into any plain text. Handling session negotiation makes the TLS protocol wrong, and man-in-the-middle attacks can inject arbitrary clear text before legitimate clients send data. Attackers can exploit this issue to obtain potentially sensitive information that may aid in further attacks. ---------------------------------------------------------------------- http://secunia.com/research/ http://secunia.com/company/jobs/open_positions/reverse_engineer ---------------------------------------------------------------------- TITLE: Hitachi Web Server Two Vulnerabilities SECUNIA ADVISORY ID: SA44309 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44309/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44309 RELEASE DATE: 2011-04-26 DISCUSS ADVISORY: http://secunia.com/advisories/44309/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44309/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44309 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been reported in Hitachi Web Server, which can be exploited by malicious people to disclose sensitive information and manipulate certain data. 1) An error in the SSL protocol can be exploited to insert arbitrary plaintext. This may be related to vulnerability #3 in: SA38776 Please see the vendor's advisory for the list of affected versions. SOLUTION: Apply patches. Please see the vendor's advisory for more information. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS11-006/index.html http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS11-007/index.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

IOT TAXONOMY

AFFECTED PRODUCTS

THREAT TYPE

network

TYPE

Unknown

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Hitachi

SOURCES

LAST UPDATE DATE

2022-05-17T22:47:50.123000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE