Note: This is an archival copy of Security Sun Alert 200080 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000064.1.
Article ID : 1000064.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2007-08-02
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

A Security Vulnerability in Processing XSLT Style Sheets Affects Sun Java System Portal Server Software 7.0

Category
Security

Release Phase
Resolved

Product
Sun Java System Portal Server 7

Bug Id
6576529

Date of Resolved Release
03-AUG-2007

Impact

Sun Java System Portal Server Software 7.0 may not securely process XSLT style sheets contained in XSLT Transforms in XML Signatures. This may allow malicious XLST style sheets to be executed. For example, an arbitrary Java method could be executed due to this vulnerability.

Sun acknowledges, with thanks, Brad Hill of iSEC Partners, for bringing this issue to our attention.


Contributing Factors

This issue can occur in the following releases:

SPARC Platform

  • Sun Java System Portal Server Software 7.0 (for Solaris 8, 9 and 10) without patch 121913-15

x86 Platform

  • Sun Java System Portal Server Software 7.0 (for Solaris 8, 9 and 10) without patch 121914-15

Linux Platform

  • Sun Java System Portal Server Software 7.0 without patch 121915-15

To determine the version of Sun Java System Portal Server Software installed on a system, the following command can be run:

    # <PS_INSTALL_DIR>/bin/psadmin version -u amadmin -f passwordFile
    Mon Dec 12 01:10:23 PST 2005 Sun Java(tm) System Portal Server 7.0

Note: Portal Server Software versions 6.3.1 or earlier and  versions 7.1 and 7.1u1 are not impacted by this issue.


Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited.


Workaround

There is no workaround for this issue. Please see the Resolution section below.


Resolution

This issue is addressed in the following releases:

SPARC Platform

  • Sun Java System Portal Server Software 7.0 (for Solaris 8, 9 and 10) with patch 121913-15 or later

x86 Platform

  • Sun Java System Portal Server Software 7.0 (for Solaris 8, 9 and 10) with patch 121914-15 or later

Linux Platform

  • Sun Java System Portal Server Software 7.0 with patch 121915-15 or later


References

121913-15
121914-15
121915-15




Attachments
This solution has no attachment