Remove Win 2008 Server´s Vulnerability (FastCGI [login to view URL] Cross-Site Scripting)

We need to Remove Win 2008 Server´s Vulnerability (FastCGI [login to view URL] Cross-Site Scripting)

Description

A cross-site scripting vulnerability in FastCGI [login to view URL] CGI script allows remote attackers to submit requests containing potentially malicious html or scripts to the Web server.

Observation

FastCGI is an extension of the Common Gateway Interface for different Web server platforms. Oracle Application Server and other Web server applications include the [login to view URL] FastCGI sample application. [login to view URL] returns server environment data or any parameters submitted to it. If remote attackers include scripts in parameters sent to [login to view URL], the Web client executes the script as though it were a legitimate script on the targeted server. Vulnerable systems: FastCGI - Apache 1.3.x, Oracle 9iAS For more information see: [login to view URL]

Recommendation

McAfee is unaware of any vendor supplied patch or update (2014-07-28) The following workaround is available: McAfee recommends that you remove the FastCGI sample scripts, including [login to view URL], from any server in a production environment.

After the job is done, we are going to re-scan the system looking for this vulnerability, if this is not present on the server, we will release the payment.

Thanks

Apache Tietoturva Oracle Järjestelmänvalvoja Verkkoturva

Projektin tunnus: #9035294

Tietoa projektista