BID:28113

Sun Java System Access Manager Administration Console Multiple Cross-Site Scripting Vulnerabilities

Info

Sun Java System Access Manager Administration Console Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	28113
Class:	Input Validation Error
CVE:	CVE-2008-1204
Remote:	Yes
Local:	No
Published:	Feb 27 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Steven Adair of NASA discovered these issues.
Vulnerable:	Sun Java System Access Manager 7.1 Windows Sun Java System Access Manager 7.1 Solaris x86 Sun Java System Access Manager 7.1 Solaris SPARC Sun Java System Access Manager 7.1 Linux Sun Java System Access Manager 7.1 HP-UX Sun Java System Access Manager 7.0 2005Q4 Windows Sun Java System Access Manager 7.0 2005Q4 Solaris x Sun Java System Access Manager 7.0 2005Q4 Solaris S Sun Java System Access Manager 7.0 2005Q4 Linux Sun Java System Access Manager 7.0 2005Q4 HP-UX

Not Vulnerable:

Discussion

Sun Java System Access Manager Administration Console Multiple Cross-Site Scripting Vulnerabilities

Sun Java System Access Manager is prone to multiple cross-site scripting vulnerabilities that affect the Administration Console.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect Sun Java System Access Manager 7.1 and 7 2005Q4 (7.0).

Exploit / POC

Sun Java System Access Manager Administration Console Multiple Cross-Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Solution / Fix

Sun Java System Access Manager Administration Console Multiple Cross-Site Scripting Vulnerabilities

Solution:
The vendor has released patches to address these issues. Please see the references for more information.

Sun Java System Access Manager 7.0 2005Q4 Windows