• info
• discussion
• exploit
• solution
• references

Apache Struts Error Response Cross-Site Scripting Vulnerability

Solution:
Red Hat has released advisory RHSA-2006:0157-01 along with fixes to address this issue for Red Hat Application Server 3. Please see the referenced advisory for more information.

The vendor has addressed this issue in version 1.2.8:


Apache Software Foundation Struts 1.2.7

• Apache Software Foundation struts-1.2.8-src.tar.gz
  http://struts.apache.org/download.cgi


• RedHat jakarta-commons-validator-1.1.4-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3AS:
  ftp://updates.redhat.com/enterprise/3AS/en/RHAPS/SRPMS/jakarta-commons -validator-1.1.4-1jpp_2rh.noarch.rpm


• RedHat jakarta-commons-validator-1.1.4-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3ES:
  ftp://updates.redhat.com/enterprise/3ES/en/RHAPS/SRPMS/jakarta-commons -validator-1.1.4-1jpp_2rh.noarch.rpm


• RedHat jakarta-commons-validator-1.1.4-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3WS:
  ftp://updates.redhat.com/enterprise/3WS/en/RHAPS/SRPMS/jakarta-commons -validator-1.1.4-1jpp_2rh.noarch.rpm


• RedHat jakarta-commons-validator-javadoc-1.1.4-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3AS:
  ftp://updates.redhat.com/enterprise/3AS/en/RHAPS/SRPMS/jakarta-commons -validator-javadoc-1.1.4-1jpp_2rh.noarch.rpm


• RedHat jakarta-commons-validator-javadoc-1.1.4-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3ES:
  ftp://updates.redhat.com/enterprise/3ES/en/RHAPS/SRPMS/jakarta-commons -validator-javadoc-1.1.4-1jpp_2rh.noarch.rpm


• RedHat jakarta-commons-validator-javadoc-1.1.4-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3WS:
  ftp://updates.redhat.com/enterprise/3WS/en/RHAPS/SRPMS/jakarta-commons -validator-javadoc-1.1.4-1jpp_2rh.noarch.rpm


• RedHat struts-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3AS:
  ftp://updates.redhat.com/enterprise/3AS/en/RHAPS/SRPMS/struts-1.2.8-1j pp_2rh.noarch.rpm


• RedHat struts-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3ES:
  ftp://updates.redhat.com/enterprise/3ES/en/RHAPS/SRPMS/struts-1.2.8-1j pp_2rh.noarch.rpm


• RedHat struts-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3WS:
  ftp://updates.redhat.com/enterprise/3WS/en/RHAPS/SRPMS/struts-1.2.8-1j pp_2rh.noarch.rpm


• RedHat struts-javadoc-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3AS:
  ftp://updates.redhat.com/enterprise/3AS/en/RHAPS/SRPMS/struts-javadoc- 1.2.8-1jpp_2rh.noarch.rpm


• RedHat struts-javadoc-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3ES:
  ftp://updates.redhat.com/enterprise/3ES/en/RHAPS/SRPMS/struts-javadoc- 1.2.8-1jpp_2rh.noarch.rpm


• RedHat struts-javadoc-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3WS:
  ftp://updates.redhat.com/enterprise/3WS/en/RHAPS/SRPMS/struts-javadoc- 1.2.8-1jpp_2rh.noarch.rpm


• RedHat struts-manual-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3AS:
  ftp://updates.redhat.com/enterprise/3AS/en/RHAPS/SRPMS/struts-manual-1 .2.8-1jpp_2rh.noarch.rpm


• RedHat struts-manual-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3ES:
  ftp://updates.redhat.com/enterprise/3ES/en/RHAPS/SRPMS/struts-manual-1 .2.8-1jpp_2rh.noarch.rpm


• RedHat struts-manual-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3WS:
  ftp://updates.redhat.com/enterprise/3WS/en/RHAPS/SRPMS/struts-manual-1 .2.8-1jpp_2rh.noarch.rpm


• RedHat struts-webapps-tomcat5-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3AS:
  ftp://updates.redhat.com/enterprise/3AS/en/RHAPS/SRPMS/struts-webapps- tomcat5-1.2.8-1jpp_2rh.noarch.rpm


• RedHat struts-webapps-tomcat5-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3ES:
  ftp://updates.redhat.com/enterprise/3ES/en/RHAPS/SRPMS/struts-webapps- tomcat5-1.2.8-1jpp_2rh.noarch.rpm


• RedHat struts-webapps-tomcat5-1.2.8-1jpp_2rh.noarch.rpm
  Red Hat Application Server 3WS:
  ftp://updates.redhat.com/enterprise/3WS/en/RHAPS/SRPMS/struts-webapps- tomcat5-1.2.8-1jpp_2rh.noarch.rpm