Sun ONE and Sun Java System Application Server Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	18635
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 23 2006 12:00AM
Updated:	Jun 26 2006 04:15PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Sun ONE Application Server Standard Edition 7.0.0 UR8 Sun ONE Application Server 7.0 UR7 Standard Edition Sun ONE Application Server 7.0 UR7 Platform Edition Sun ONE Application Server 7.0 UR6 Standard Edition Sun ONE Application Server 7.0 UR6 Platform Edition Sun ONE Application Server 7.0 UR2 Upgrade Standard Sun ONE Application Server 7.0 UR2 Upgrade Platform Sun ONE Application Server 7.0 UR2 Standard Edition Sun ONE Application Server 7.0 UR2 Platform Edition Sun ONE Application Server 7.0 UR1 Standard Edition Sun ONE Application Server 7.0 UR1 Platform Edition Sun ONE Application Server 7.0 Standard Edition Sun ONE Application Server 7.0 Platform Edition Sun ONE Application Server 7.0.0 UR8 Platform E Sun Java System Application Server Standard 7.0.0 2004Q2 R4 Sun Java System Application Server Enterprise Edition 8.1 2005Q1RHEL2.1/RHEL3 Sun Java System Application Server Enterprise Edition 8.1 2005 Q1 Sun Java System Application Server Enterprise 7.0.0 2004Q2 R4 Sun Java System Application Server 7.0 2004Q2 R3 Standard Sun Java System Application Server 7.0 2004Q2 R3 Enterprise Sun Java System Application Server 7.0 2004Q2 R2 Standard Sun Java System Application Server 7.0 2004Q2 R2 Enterprise Sun Java System Application Server 7.0 2004Q2 R1Standard Sun Java System Application Server 7.0 2004Q2 R1Enterprise Sun Java System Application Server 7.0 2004Q2
Not Vulnerable:	Sun ONE Application Server Standard Edition 7.0.0 UR9 Sun ONE Application Server Platform Edition 7.0.0 UR9 Sun Java System Application Server Standard 7.0.0 2004Q2 R5 Sun Java System Application Server Enterprise 7.0.0 2004Q2 R5

Sun ONE and Sun Java System Application Server Unspecified Cross-Site Scripting Vulnerability

Sun One and Sun Java System Application Server are prone to an unspecified cross-site scripting vulnerability. This issue is due to a failure in the applications to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Sun ONE and Sun Java System Application Server Unspecified Cross-Site Scripting Vulnerability

This issue can be exploited through a web client.

Sun ONE and Sun Java System Application Server Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released updates to address this issue.


Sun Java System Application Server Enterprise Edition 8.1 2005Q1RHEL2.1/RHEL3

• Sun 119168-16
  SVR4 patch for Linux RHEL2.1/RHEL3.0.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119168-16-1

Sun Java System Application Server Enterprise Edition 8.1 2005 Q1

• Sun 119166-16
  SVR4 patch for SPARC.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119166-16-1


• Sun 119167-16
  SVR4 patch for x86.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119167-16-1


• Sun 119169-08
  File based patch for SPARC.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119169-08-1


• Sun 119170-08
  File based patch for x86.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119170-08-1


• Sun 119171-08
  File based patch for Linux.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119171-08-1


• Sun 119172-08
  File based patch for Windows.
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -119172-08-1

Sun ONE and Sun Java System Application Server Unspecified Cross-Site Scripting Vulnerability

References:

• Sun Alert ID: 102479 (Sun)