Some vulnerabilities and a security issue have been reported in IBM WebSphere Application Server. One vulnerability has an unknown impact, the others can be exploited by malicious people to cause a DoS (Denial of Service) or bypass certain security restrictions.

1) A vulnerability is caused due to an unspecified error when the "fileServing" feature is enabled.

This is related to:
SA31892

2) An error in the processing of HTTP requests can be exploited to cause an "0C4" abend in the controller via a specially crafted request containing an overly long HTTP "Host" header (more than 256 bytes), and may hang the server.

3) A security issue is caused due to Web services security not properly processing Certificate Revocation Lists (CRL). This can lead to revoked X509 certificates not being rejected by the system.

4) A vulnerability in the "mod_proxy" module can be exploited by malicious people to cause a DoS.

For more information:
SA30621

Solution
IBM WebSphere Application Server 6.0.x:
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
IBM (PK64302, PK69371, PK61258, PK67579):
http://www-01.ibm.com/support/docview.wss?uid=swg27006876

ISS X-Force:
http://xforce.iss.net/xforce/xfdb/42987

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers