Sun Java System Web Proxy Server FTP Subsytem Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	31691
Class:	Boundary Condition Error
CVE:	CVE-2008-4541
Remote:	Yes
Local:	No
Published:	Oct 10 2008 12:00AM
Updated:	Apr 16 2015 05:52PM
Credit:	iDefense
Vulnerable:	Sun Java Web Proxy Server 4.0.7 Sun Java Web Proxy Server 4.0.6 Sun Java Web Proxy Server 4.0.5 Sun Java Web Proxy Server 4.0.4 Sun Java Web Proxy Server 4.0.3 Sun Java Web Proxy Server 4.0.2 Sun Java Web Proxy Server 4.0 SP1 Sun Java Web Proxy Server 4.0
Not Vulnerable:

Sun Java System Web Proxy Server FTP Subsytem Heap Based Buffer Overflow Vulnerability

Sun Java System Web Proxy Server is prone to a heap-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects Sun Java System Web Proxy Server 4.0 up to and including 4.0.7.

Sun Java System Web Proxy Server FTP Subsytem Heap Based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Java System Web Proxy Server FTP Subsytem Heap Based Buffer Overflow Vulnerability

Solution:
The vendor released an advisory and updates to address this issue. Please see the references for more information.

Sun Java System Web Proxy Server FTP Subsytem Heap Based Buffer Overflow Vulnerability

References:

• Sun Java Web Proxy Server Homepage (Sun Microsystems)
  
• iDefense Security Advisory 10.14.08: Sun Java Web Proxy Server FTP Resource Hand ("[email protected]" )
  
• Solution 242986: A Heap Overflow Security Vulnerability in the Sun Java Web Prox (Sun)
  
• Sun Java Web Proxy Server FTP Resource Handling Heap-Based Buffer Overflow (iDefense)