Sun Java System Web Proxy Server Buffer Overflow May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1012005
|
|
SecurityTracker URL: http://securitytracker.com/id?1012005
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Oct 30 2004
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 3.6 Service Pack 4 and earlier
|
Description: A buffer overflow vulnerability was reported in Sun Java System Web Proxy Server. A remote user may be able to cause the Web Proxy Server or the Web Proxy Server's Admin Server to crash or to execute arbitrary code.
Sun reported that the proxy server does not properly handle CONNECT Request URIs and that the proxy admin server has various buffer
management flaws.
Sun Java System Web Proxy Server 3.6 Service Pack 4 and earlier are affected.
Sun credits Matt Moore of
Pentest Limited with reporting this flaw.
|
Impact: A remote user may be able to cause the Web Proxy Server or the Web Proxy Server's Admin Server to crash or to execute arbitrary code.
|
Solution: Sun has released a fix in version 3.6 Service Pack 5 (or later), available at:
http://wwws.sun.com/software/download/products/4149bc42.html
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-57606-1 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
Underlying OS Comments: May only affected Windows, but this has not been confirmed
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 30 Oct 2004 07:40:39 -0400
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57606-1
|
Sun reported a buffer overflow vulnerability in Sun Java System Web Proxy Server. A
remote user may be able to cause the Web Proxy Server or the Web Proxy Server's Admin
Server to crash or to execute arbitrary code.
Sun credits Matt Moore of Pentest Limited with reporting this flaw.
Sun Java System Web Proxy Server 3.6 Service Pack 4 and earlier are affected.
Sun has released a fix in version 3.6 Service Pack 5 (or later), available at:
http://wwws.sun.com/software/download/products/4149bc42.html
----
* Sun Alert ID: 57606
* Synopsis: Buffer Overflow Vulnerabilities in Sun Java System Web Proxy Server
* Category: Security
* Product: Sun Java System Web Proxy Server
* BugIDs: 4973815, 4973816
* Avoidance: Upgrade
* State: Resolved
* Date Released: 29-Oct-2004
* Date Closed: 29-Oct-2004
* Date Modified:
|
|
