Re: Websphere 3.5

[yossarian () planet nl]

Apart from not being supported by IBM any longer? Insecurities in WAS usually emerge from how you deploy it (LDAP? - 
remember that ldap requests are usually clear text)(and hardly anyone ever managed to get Global Security working so 
often the admin console is not secured), are specific to the version (*nix?, OS390?, Windows?, 3.5.6 or other fixlevel) 
and type (EE, AE etc...). Besides, keeping WAS 3.5 on the right fixlevel all over can really be a pain. 

Anyway I advise you to NEVER deploy Was3.5 if webfacing without some sort of EDGE technology, i.e. some reverse proxy. 
And of course for WAS 3.5 - go for the apache layer. It is very likely to be an older one. Then google for Apache 
1.3.17 exploits. Or go to apache.org ....

Good luck

(BTW don't 0wn things you don't own)

----- Oorspronkelijk bericht -----
Van: Alerta Redsegura <alerta () redsegura com>
Datum: donderdag, oktober 21, 2004 7:25 pm
Onderwerp: [Full-Disclosure] Websphere 3.5

> Hi,
>
> Anyone aware of vulnerabilities (besides those you can find 
> Googling) in
> Websphere 3.5?
>
>
> Regards,
>
>
> Iñigo
> alerta () redsegura com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html