PeopleSoft vulnerability threatens data
Published: 21 Jan 2003 11:00 GMT
A serious vulnerability, which may allow attackers to obtain confidential information, was found in PeopleSoft's Application Messaging Gateway servlet.
Network security firm Internet Security Systems (ISS) discovered the security glitch, which is present in default installations. The vulnerability affects all 8.1x versions of PeopleTools, with the exception of 8.19. 8.4x versions are also not affected.
"PeopleSoft has addressed all of the issues in PeopleTools 8.19, which will be available on PeopleSoft's Customer Connection site in early February," ISS said in a statement.
"In the mean time, ISS X-Force recommends that all PeopleSoft administrators block or restrict access to the servlets in question. X-Force also recommends that administrators take advantage of the security mechanisms that BEA WebLogic Servers provide," the security firm said.
ISS has of late been heavily critised for disclosing security vulnerabilities without giving software companies adequate time to engineer security fixes. Last June, the firm issued a statement after discovering a critical flaw in the Apache Web server before notifying the Apache Software Foundation, the group responsible for maintaining the software.
Let the editors know what you think in the Mailroom.
Did you find this article useful?
96 out of 157 people found this useful
- Share this article:
