Multiple vulnerabilities have been identified in IBM WebSphere Application Server, which could be exploited by attackers to cause a denial of service or gain knowledge of sensitive information, and by malicious users to bypass security restrictions.
The first issue is caused by an unspecified security exposure with "fileServing" feature enabled. For additional information, see : VUPEN/ADV-2008-2566
The second vulnerability is caused by an error in the HTTP Transport component when processing an overly long host header, which could lead to an 0C4 abend in WebSphere controller.
The third issue is caused due to the Web Services component not honoring certificate revocation lists in cert store collections.
The fourth weakness is caused due to the Installation Factory installation process storing sensitive information in the "logs/instconfigifwas6.log" file when WAS is registered as a Windows service, which could allow local users to obtain sensitive information.
