Sun Java System Directory Server Multiple Remote Vulnerabilities

Bugtraq ID:	37481
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 28 2009 12:00AM
Updated:	Dec 29 2009 08:43PM
Credit:	Sun
Vulnerable:	Sun Java System Directory Server Enterprise Edition 6.3.1 Sun Java System Directory Server Enterprise Edition 6.3 Sun Java System Directory Server Enterprise Edition 6.2 Sun Java System Directory Server Enterprise Edition 6.1 Sun Java System Directory Server Enterprise Edition 6.0
Not Vulnerable:

Sun Java System Directory Server Multiple Remote Vulnerabilities

Sun Java System Directory Server is prone to a multiple remote vulnerabilities:

- A remote code-execution vulnerability
- Multiple denial-of-service vulnerabilities

Remote attackers can exploit these issues to execute arbitrary code with the privileges of the victim user, cause the server to stop responding to new client connections, and prevent the server from sending results to other 'psearch' clients.

Sun Java System Directory Server Enterprise Edition 6.0, 6.1, 6.2, 6.3, and 6.3.1 are vulnerable.

Sun Java System Directory Server Multiple Remote Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Java System Directory Server Multiple Remote Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.


Sun Java System Directory Server Enterprise Edition 6.3.1

• Sun 141958-01
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -141958-01-1

Sun Java System Directory Server Multiple Remote Vulnerabilities

References:

• Sun Java System Directory Server Homepage (Sun)
  
• Directory Proxy Server Provided with Directory Server Enterprise Edition 6 is Su (Sun Microsystems)