Sun Java System Web Server HTTP 'TRACE' Heap Buffer Overflow Vulnerability

Bugtraq ID:	37648
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2010 12:00AM
Updated:	Jan 25 2010 07:41PM
Credit:	Evgeny Legerov
Vulnerable:	Sun Java System Web Server 6.1 SP9 Sun Java System Web Server 6.1 SP8 Sun Java System Web Server 6.1 SP7 Sun Java System Web Server 6.1 SP6 Sun Java System Web Server 6.1 SP5 Sun Java System Web Server 6.1 SP4 Sun Java System Web Server 6.1 SP3 Sun Java System Web Server 6.1 SP2 Sun Java System Web Server 6.1 SP11 Sun Java System Web Server 6.1 SP10 Sun Java System Web Server 6.1 SP1 Sun Java System Web Server 6.1 Sun Java System Web Server 7.0 Update 7 Sun Java System Web Server 7.0 Update 6 Sun Java System Web Server 7.0 Update 3 Sun Java System Web Server 7.0 Update 2 Sun Java System Web Server 7.0 Update 1 Sun Java System Web Server 7.0 Sun Java System Web Server 7.0 Sun Java System Web Proxy Server 4.0.12 Sun Java System Web Proxy Server 4.0.5 Sun Java System Web Proxy Server 4.0
Not Vulnerable:

Sun Java System Web Server HTTP 'TRACE' Heap Buffer Overflow Vulnerability

Sun Java System Web Server is prone to a remote heap-based buffer-overflow vulnerability.

Attackers can exploit this issue to crash the affected application or to obtain potentially sensitive information that may aid in further attacks.

The following are vulnerable:

Sun Java System Web Server 7.0 prior to 7.0 Update 8
Sun Java System Web Server 6.1 prior to 6.1 Service Pack 12
Sun Java System Web Proxy Server 4.0 prior to 4.0 Service Pack 13

Sun Java System Web Server HTTP 'TRACE' Heap Buffer Overflow Vulnerability

Attackers can exploit the issue via readily available tools.

The following exploit is available:

• /data/vulnerabilities/exploits/37648.py

Sun Java System Web Server HTTP 'TRACE' Heap Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Java System Web Server HTTP 'TRACE' Heap Buffer Overflow Vulnerability

References:

• 0day demos (Evgeny Legerov)
  
• Sun Java System Web Server 7.0u7 TRACE overflow (Evgeny Legerov)
  
• Sun Java System Web Server Homepage (Sun)
  
• Multiple security vulnerabilities in the HTTP TRACE, WebDAV and Digest Authentic (Sun)