Sun Java System Calendar Server Duplicate URI Request Denial of Service Vulnerability

Bugtraq ID:	34150
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Mar 31 2009 12:00AM
Updated:	Apr 07 2009 04:26PM
Credit:	SCS team from Core Security Technologies
Vulnerable:	Sun Java System Calendar Server 6.3-7.01 Sun Java System Calendar Server 6.3
Not Vulnerable:

Sun Java System Calendar Server Duplicate URI Request Denial of Service Vulnerability

Sun Java System Calendar Server is prone to a denial-of-service vulnerability because it fails to handle certain duplicate URI requests.

An attacker can exploit this issue to crash the Calendar Server, resulting in a denial-of-service condition.

NOTE: Versions prior to Sun Java System Calendar Server 6.3 are not vulnerable.

Sun Java System Calendar Server Duplicate URI Request Denial of Service Vulnerability

Attackers can exploit this issue via a browser.

The following example data is available:

https://www.example.com:3443/?tzid=crash

Sun Java System Calendar Server Duplicate URI Request Denial of Service Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

Sun Java System Calendar Server Duplicate URI Request Denial of Service Vulnerability

References:

• Sun Java System Calendar Server Homepage (Sun)
  
• CORE-2009-0108: Multiple vulnerabilities in Sun Calendar Express Web Server (CORE Security Technologies Advisories )
  
• CORE-2009-0108 Multiple vulnerabilities in Sun Calendar Express Web Server (Core)
  
• Solution 255008 : Security Vulnerability in Sun Java System Calendar Server 6 (Sun)