Note: This is an archival copy of Security Sun Alert 201592 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1001197.1.
Article ID : 1001197.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2005-09-28
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerability in Webmail May Allow an Unprivileged User to Execute Arbitrary Code



Category
Security

Release Phase
Resolved

Product
iPlanet Messaging Server 5.2 Patch 1
Sun Java System Messaging Server 6.2 EA

Bug Id
6284060

Date of Workaround Release
17-JUN-2005

Date of Resolved Release
29-SEP-2005

Impact

A new security vulnerability in the iPlanet Messaging Server/Sun ONE Messaging Server may allow a remote unprivileged user the ability to cause JavaScript to be evaluated in a local user's Internet Explorer (IE) browser and thus execute arbitrary code with the privileges of the user running IE.

Note: This issue only occurs when the client browser is Internet Explorer (IE).


Contributing Factors

This issue can occur in the following releases:

SPARC Platform

  • iPlanet Messaging Server 5.2 (for Solaris 2.6 and Solaris 8) without patch 5.2hf2.07
  • Sun ONE Messaging Server 6.2 (for Solaris 8, Solaris 9, Solaris 10) without patch 118207-37

x86 Platform

  • Sun ONE Messaging Server 6.2 (for Solaris 9 and Solaris 10) without patch 118208-36

Linux Platform

  • Sun ONE Messaging Server 6.2 (for RHEL 2.1 or 3.0) without patch 118209-36

Notes:

  1. iPlanet Messaging Server 5.2 is not supported on Solaris 7.
  2. Sun ONE Messaging Server 6.2 is not supported on Solaris 7 or Solaris 8 on the x86 platform.

Symptoms

There are no reliable symptoms that would indicate the described issue has been exploited.


Workaround

There is no workaround. Please see the Resolution section below.


Resolution

This issue is addressed in the following releases:

SPARC Platform

  • iPlanet Messaging Server 5.2 (for Solaris 2.6 and Solaris 8) with patch 5.2hf2.07 or later
  • Sun ONE Messaging Server 6.2 (for Solaris 8, Solaris 9, Solaris 10) with patch 118207-37 or later

x86 Platform

  • Sun ONE Messaging Server 6.2 (for Solaris 9 and Solaris 10) with patch 118208-36 or later

Linux Platform

  • Sun ONE Messaging Server 6.2 (for RHEL 2.1 or 3.0) with patch 118209-36 or later

Note: iPlanet Messaging Server 5.2 patch 5.2hf2.02 is available through normal support channels.



Modification History
Date: 25-AUG-2005

25-Aug-2005:

  • Update Contributing Factors and Resolution sections

Date: 12-SEP-2005

12-Sep-2005:

  • Updated Contributing Factors and Resolution sections

Date: 29-SEP-2005

29-Sep-2005:

  • Update Contributing Factors and Resolution sections, re-release as Resolved


References

118207-36
118208-36
118209-36




Attachments
This solution has no attachment