Sun Java System Web Server '.jsp' File Information Disclosure Vulnerability
BID:35577
Info
Sun Java System Web Server '.jsp' File Information Disclosure Vulnerability
| Bugtraq ID: | 35577 |
| Class: | Access Validation Error |
| CVE: |
CVE-2009-2445 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 06 2009 12:00AM |
| Updated: | Aug 28 2009 04:12PM |
| Credit: | Nikolaos Rangos |
| Vulnerable: |
Sun Java System Web Server 7.0 Plugin 0 Sun Java System Web Server 6.1 SP9 Sun Java System Web Server 6.1 SP8 Sun Java System Web Server 6.1 SP7 Sun Java System Web Server 6.1 SP6 Sun Java System Web Server 6.1 SP5 Sun Java System Web Server 6.1 SP4 Sun Java System Web Server 6.1 SP3 Sun Java System Web Server 6.1 SP2 Sun Java System Web Server 6.1 SP11 Sun Java System Web Server 6.1 SP10 Sun Java System Web Server 6.1 SP1 Sun Java System Web Server 6.1 Sun Java System Web Server 7.0 Update 3 Sun Java System Web Server 7.0 Update 2 Sun Java System Web Server 7.0 Update 1 Sun Java System Web Server 7.0 Sun Java System Web Server 7.0 |
| Not Vulnerable: | |
Discussion
Sun Java System Web Server '.jsp' File Information Disclosure Vulnerability
Sun Java System Web Server is prone to a remote information-disclosure vulnerability.
Attackers can exploit this issue to obtain potentially sensitive information that may aid in further attacks.
The vulnerability affects Sun Java System Web Server 6.1 SP10, 6.1 SP11, and 7.0; other versions may also be affected.
Sun Java System Web Server is prone to a remote information-disclosure vulnerability.
Attackers can exploit this issue to obtain potentially sensitive information that may aid in further attacks.
The vulnerability affects Sun Java System Web Server 6.1 SP10, 6.1 SP11, and 7.0; other versions may also be affected.
Exploit / POC
Sun Java System Web Server '.jsp' File Information Disclosure Vulnerability
Attackers can exploit the issue via a browser.
The following example URI is available:
http://www.example.com/hello.jsp::$DATA
Attackers can exploit the issue via a browser.
The following example URI is available:
http://www.example.com/hello.jsp::$DATA
Solution / Fix
Sun Java System Web Server '.jsp' File Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Sun Java System Web Server '.jsp' File Information Disclosure Vulnerability
References:
References: