Note: This is an archival copy of Security Sun Alert 200019 as previously published on http://sunsolve.sun.com. Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000016.1. |
Category Security Release Phase Resolved Sun Java System Application Server Standard Edition 7 2004Q2 Sun ONE Application Server 7, Standard Edition Sun Java System Web Server 6.1 Service Pack 4 Sun ONE Web Server 6.0 Service Pack 9 Sun Java System Application Server Enterprise Edition 7 2004Q2 Sun ONE Application Server 7, Platform Edition Bug Id 6239342, 6240424, 6240422 Date of Resolved Release 18-MAY-2006 Impact A Cross Site Scripting (XSS) vulnerability in various releases of the Sun Java System Web Server and Sun Java System Application Server may allow an unprivileged local or remote user to steal cookie information, hijack sessions, or cause a loss of data privacy between a client and the server. Sun acknowledges with thanks, CERT and JPCERT/CC for bringing this issue to our attention. This issue is described in JPCERT/CC Vulnerability JVN#03D5EAA8 at http://jvn.jp/jp/JVN%2303D5EAA8/index.html Sun also acknowledges with thanks, Little eArth Corporation Co., Ltd., for discovering and reporting this issue. Contributing Factors This issue can occur in the following releases:
To determine the version of Sun Java System Application Server on a system, the following command can be run: $ <AS_INSTALL>/bin/asadmin version --verbose Sun Java System Application Server 7 2004Q2UR3 (build A051525-273129) (Where <AS_INSTALL> is the installation directory of the Application Server) To determine the version of Sun ONE Application Server on a system, the following command can be run: $ <WS-install>/https-<host>/start -version where <WS-install> is top installation directory of Web Server and <host> should be the actual host name on which the Web Server is installed. Symptoms There are no predictable symptoms that would indicate the described issue has occurred. Workaround There is no workaround to this issue. Please see the Resolution section below. Resolution This issue is addressed in the following releases:
http://www.sun.com/download/products.xml?id=43a84f89
http://www.sun.com/download/products.xml?id=434aec1d (International version at http://www.sun.com/download/products.xml?id=43c43041)
http://www.sun.com/download/products.xml?id=42ae3178
http://www.sun.com/download/products.xml?id=42ae317c
http://www.sun.com/download/products.xml?id=427fe06d
http://javashoplm.sun.com/ECom/docs/Welcome.jsp?StoreId=8&PartDetailId=SJAS72004Q2U3-EE-OTH-G-ES Modification History Date: 17-JUL-2006 17-Jul-2006:
Attachments This solution has no attachment |
|