SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Sun Java Web Proxy Server Vendors:   Sun
Sun Java System Web Proxy Server Buffer Overflow May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1012005
SecurityTracker URL:  http://securitytracker.com/id/1012005
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 30 2004
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.6 Service Pack 4 and earlier
Description:   A buffer overflow vulnerability was reported in Sun Java System Web Proxy Server. A remote user may be able to cause the Web Proxy Server or the Web Proxy Server's Admin Server to crash or to execute arbitrary code.

Sun reported that the proxy server does not properly handle CONNECT Request URIs and that the proxy admin server has various buffer management flaws.

Sun Java System Web Proxy Server 3.6 Service Pack 4 and earlier are affected.

Sun credits Matt Moore of Pentest Limited with reporting this flaw.

Impact:   A remote user may be able to cause the Web Proxy Server or the Web Proxy Server's Admin Server to crash or to execute arbitrary code.
Solution:   Sun has released a fix in version 3.6 Service Pack 5 (or later), available at:

http://wwws.sun.com/software/download/products/4149bc42.html

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-26-57606-1 (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
Underlying OS Comments:  May only affected Windows, but this has not been confirmed

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC