Note: This is an archival copy of Security Sun Alert 200019 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000016.1.
Sun Java System Application Server Standard Edition 7 2004Q2
Sun ONE Application Server 7, Standard Edition
Sun Java System Web Server 6.1 Service Pack 4
Sun ONE Web Server 6.0 Service Pack 9
Sun Java System Application Server Enterprise Edition 7 2004Q2
Sun ONE Application Server 7, Platform Edition
6239342, 6240424, 6240422
Date of Resolved Release
A Cross Site Scripting (XSS) vulnerability in various releases of the Sun Java System Web Server and Sun Java System Application Server may allow an unprivileged local or remote user to steal cookie information, hijack sessions, or cause a loss of data privacy between a client and the server.
Sun acknowledges with thanks, CERT and JPCERT/CC for bringing this issue to our attention.
This issue is described in JPCERT/CC Vulnerability JVN#03D5EAA8 at http://jvn.jp/jp/JVN%2303D5EAA8/index.html
Sun also acknowledges with thanks, Little eArth Corporation Co., Ltd., for discovering and reporting this issue.
This issue can occur in the following releases:
To determine the version of Sun Java System Application Server on a system, the following command can be run:
$ <AS_INSTALL>/bin/asadmin version --verbose Sun Java System Application Server 7 2004Q2UR3 (build A051525-273129)
(Where <AS_INSTALL> is the installation directory of the Application Server)
To determine the version of Sun ONE Application Server on a system, the following command can be run:
$ <WS-install>/https-<host>/start -version
where <WS-install> is top installation directory of Web Server and <host> should be the actual host name on which the Web Server is installed.
There are no predictable symptoms that would indicate the described issue has occurred.
There is no workaround to this issue. Please see the Resolution section below.
This issue is addressed in the following releases:
(International version at http://www.sun.com/download/products.xml?id=43c43041)
This solution has no attachment