A security issue has been reported in various NEC WebOTX products, which potentially can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to a synchronisation problem when checking IP addresses and can be exploited to bypass a filter valve that extends "RemoteFilterValve" and potentially gain access to protected contexts.

The security issue is reported in the following products and versions:
* WebOTX Web Edition version 4.x through 5.x
* WebOTX Standard-J Edition version 4.x through 5.x
* WebOTX Standard Edition version 4.x through 5.x
* WebOTX Enterprise Edition version 4.x through 5.x
* WebOTX UDDI Registry version 1.1 through 2.1

Solution
Reportedly, patches are available. Contact the vendor's sales department for more information.

Provided and/or discovered by
Kenichi Tsukamoto of Development Dept. II Application Management Middleware Div. FUJITSU LIMITED

Original Advisory
NEC:
http://www.nec.co.jp/security-info/secinfo/nv09-006.html

JVN:
http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000069.html

Deep Links
Links available in Customer Area