Exploit for GWT-RPC

[opn]

I just read this:
http://www.allinfosec.com/2011/07/27/webapps-0day-ca-arcserve-d2d-r15-gwt-rpc-multiple-vulnerabilities/

I'm far from being an expert in security stuff, so my question is if
it's also an app-server specific problem that makes this possible
(Microsoft Windows Server 2003 r2 sp2) or if it does not matter on
which server it runs?

What can one do against this?

Regards
Alex

[Filipe Sousa]

I believe that's a problem with the web application. The attacker is calling the unprotected method HomepageService.getLocalHost() that returns a TrustHostModel with a hostname, password, port, user, userid,...

I'm not a security expert, but I would never request a password from server.

[Jens]

It's app specific, so its not a bug in GWT-RPC nor does it depend on the app server you use.

-- J.

[opn]

Ok, thanks for the information, that's good news!