Category
Security
Release Phase
Resolved
ProductiPlanet Messaging Server 5.2 Patch 1
Sun Java System Messaging Server 6.2 EA
Bug Id
6284060
Date of Workaround Release17-JUN-2005
Date of Resolved Release29-SEP-2005
Impact
A new security vulnerability in the iPlanet Messaging Server/Sun ONE Messaging Server may allow a remote unprivileged user the ability to cause JavaScript to be evaluated in a local user's Internet Explorer (IE) browser and thus execute arbitrary code with the privileges of the user running IE.
Note: This issue only occurs when the client browser is Internet Explorer (IE).
Contributing Factors
This issue can occur in the following releases:
SPARC Platform
- iPlanet Messaging Server 5.2 (for Solaris 2.6 and Solaris 8) without patch 5.2hf2.07
- Sun ONE Messaging Server 6.2 (for Solaris 8, Solaris 9, Solaris 10) without patch 118207-37
x86 Platform
- Sun ONE Messaging Server 6.2 (for Solaris 9 and Solaris 10) without patch 118208-36
Linux Platform
- Sun ONE Messaging Server 6.2 (for RHEL 2.1 or 3.0) without patch 118209-36
Notes:
- iPlanet Messaging Server 5.2 is not supported on Solaris 7.
- Sun ONE Messaging Server 6.2 is not supported on Solaris 7 or Solaris 8 on the x86 platform.
Symptoms
There are no reliable symptoms that would indicate the described issue has been exploited.
Workaround
There is no workaround. Please see the Resolution section below.
Resolution
This issue is addressed in the following releases:
SPARC Platform
- iPlanet Messaging Server 5.2 (for Solaris 2.6 and Solaris 8) with patch 5.2hf2.07 or later
- Sun ONE Messaging Server 6.2 (for Solaris 8, Solaris 9, Solaris 10) with patch 118207-37 or later
x86 Platform
- Sun ONE Messaging Server 6.2 (for Solaris 9 and Solaris 10) with patch 118208-36 or later
Linux Platform
- Sun ONE Messaging Server 6.2 (for RHEL 2.1 or 3.0) with patch 118209-36 or later
Note: iPlanet Messaging Server 5.2 patch 5.2hf2.02 is available through normal support channels.
Modification History
Date: 25-AUG-2005
25-Aug-2005:
- Update Contributing Factors and Resolution sections
Date: 12-SEP-2005
12-Sep-2005:
- Updated Contributing Factors and Resolution sections
Date: 29-SEP-2005
29-Sep-2005:
- Update Contributing Factors and Resolution sections, re-release as Resolved
References
118207-36
118208-36
118209-36
AttachmentsThis solution has no attachment