Secunia

Some vulnerabilities and security issues have been reported in Interstage Application Server, which can be exploited by malicious people to conduct cross-site scripting attacks or bypass certain security restrictions.

1) A vulnerability exists in the Tomcat Servlet Service when processing multiple content-length headers. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) A security issue in the Tomcat Servlet Service can be exploited to bypass access restrictions imposed on web applications.

For more information:
SA24732

3) Input passed via the "Accept-Language" header to the Tomcat Servlet Service is not properly sanitised before being returned to the user. This can be exploited to conduct cross-site scripting attacks.

For more information:
SA25721

Please see the vendor advisories for a list of affected products.

Solution
The vendor has released patches for certain versions. Please see vendor advisories for a patch matrix.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.fujitsu.com/global/support/software/security/products-f/interstage-200703e.html
2) http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.html
3) http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area