Feeds

iPlanet Server hole affects online banking

Get the bleedin' patch now

  • alert
  • submit to reddit

The essential guide to IT transformation

A serious buffer overflow vulnerability in iPlanet Web Server Enterprise Edition discovered by researchers from @Stake enables an attacker to intercept parts of another user's session by retrieving data from memory allocation pools.

Such data could include session identifiers, cookies, form submissions, login names and passwords.

"If persistent authentication credentials are used, in the form of a 'remember my password' or 'auto-login' feature, these credentials could be used at any point in the future to access the user's account," a recent @Stake advisory warns.

"We have found that iPlanet servers are commonly used in banking and finance applications. It is the third most popular Web server on the Internet and its focus is high security Web servers and the Solaris platform," @Stake's Weld Pond told The Register.

He said that Web sites for e*trade, Verisign, Morgan Stanley Dean Witter, Wells Fargo, and MasterCard all use iPlanet Server.

"There is no way for users to detect this activity and there is no way for the Web server operator to detect it. This makes it a very serious problem," he added.

iPlanet Web Server replaces Netscape Enterprise Server; but Netscape versions 3.6x don't share the vulnerability, though the entire iPlanet 4.x line does.

The vulnerability has been patched, iPlanet says. Several NSAPIs (Netscape Server APIs) are available for different platforms and have been posted here; but the company warns users that they "may incur a performance penalty," and so recommends upgrading with SP7 instead.

@Stake had already provided a fix for its clients, which can be reviewed in the advisory cited above, while waiting for iPlanet to deal with the situation.

Now that iPlanet is finally on top of it, all that remains is for systems administrators to act faster on this information than would-be malicious intruders.

Yeah, right.... ®

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.