Apart from not being supported by IBM any longer? Insecurities in WAS usually emerge from how you deploy it (LDAP? - remember that ldap requests are usually clear text)(and hardly anyone ever managed to get Global Security working so often the admin console is not secured), are specific to the version (*nix?, OS390?, Windows?, 3.5.6 or other fixlevel) and type (EE, AE etc...). Besides, keeping WAS 3.5 on the right fixlevel all over can really be a pain.
Anyway I advise you to NEVER deploy Was3.5 if webfacing without some sort of EDGE technology, i.e. some reverse proxy. And of course for WAS 3.5 - go for the apache layer. It is very likely to be an older one. Then google for Apache 1.3.17 exploits. Or go to apache.org .... Good luck (BTW don't 0wn things you don't own) ----- Oorspronkelijk bericht ----- Van: Alerta Redsegura <[EMAIL PROTECTED]> Datum: donderdag, oktober 21, 2004 7:25 pm Onderwerp: [Full-Disclosure] Websphere 3.5 > Hi, > > Anyone aware of vulnerabilities (besides those you can find > Googling) in > Websphere 3.5? > > > Regards, > > > I�igo > [EMAIL PROTECTED] > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
