HS06-022 Multiple Vulnerabilities of Hitachi Web Server

Multiple vulnerabilities were found in Hitachi Web Server (HWS). Malicious remote users can exploit the following vulnerabilities:

Vulnerability #1: Protocol-version rollback vulnerability in OpenSSL
When a client attempts to connect to a Web server by using the SSL 3.0 or TLS 1.0 protocol, an attacker might replace the connection with SSL 2.0 protocol.
Please note that this vulnerability does not affect an encrypted SSL 2.0 protocol connection.

Vulnerability #2: Cross-site scripting vulnerability with image maps
An attacker might make a malicious script in another web site, insert the script into the contents automatically created by HWS, and then execute the script on the client.

Vulnerability #3: Cross-site scripting vulnerability using an Expect header
An attacker might send a message with an Expect header containing a malicious script to HWS, insert the script into the error contents automatically created by HWS, and then execute the script on the client.

The affected products are listed below. Please upgrade the version of HWS in your system to the appropriate version.

Please note that these vulnerabilities also affect Cosminexus products that bundle HWS. For details on the affected versions, see the information on Cosminexus products.

[Affected models, versions, and fixed versions]

Hitachi Web Server products

Cosminexus products

For details on the fixed versions, contact your Hitachi support service representative.

Revision history

• January 24, 2007: Information about multiple vulnerabilities of Hitachi Web Server is released.