Sun Java System ASP Server 4.0.3 Multiple Unspecified Remote Vulnerabilities
BID:36244
Info
Sun Java System ASP Server 4.0.3 Multiple Unspecified Remote Vulnerabilities
| Bugtraq ID: | 36244 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2009 12:00AM |
| Updated: | Sep 03 2009 08:02PM |
| Credit: | Intevydis |
| Vulnerable: |
Sun Java System Active Server Pages (ASP) Server 4.0.3 |
| Not Vulnerable: | |
Discussion
Sun Java System ASP Server 4.0.3 Multiple Unspecified Remote Vulnerabilities
Sun Java System ASP Server is prone to multiple remote vulnerabilities, including:
- Two unspecified stack-based buffer-overflow vulnerabilities.
- An unspecified error in the pre-authentication phase.
- An unspecified error that can cause a stack overflow.
Attackers can exploit these issues to execute code within the context of the affected server. Failed exploit attempts will result in a denial-of-service condition.
Sun Java System ASP Server 4.0.3 is vulnerable; other versions may also be affected.
Sun Java System ASP Server is prone to multiple remote vulnerabilities, including:
- Two unspecified stack-based buffer-overflow vulnerabilities.
- An unspecified error in the pre-authentication phase.
- An unspecified error that can cause a stack overflow.
Attackers can exploit these issues to execute code within the context of the affected server. Failed exploit attempts will result in a denial-of-service condition.
Sun Java System ASP Server 4.0.3 is vulnerable; other versions may also be affected.
Exploit / POC
Sun Java System ASP Server 4.0.3 Multiple Unspecified Remote Vulnerabilities
A working commercial exploit is available through Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Sun Java System ASP Server 4.0.3 Multiple Unspecified Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Sun Java System ASP Server 4.0.3 Multiple Unspecified Remote Vulnerabilities
References:
References:
- Java System Active Server Pages Homepage (Sun)
- VulnDisco Pack Professional (Intevydis)