Sun Java System Web Server Digest Authentication Remote Buffer Overflow Vulnerability
BID:37896
Info
Sun Java System Web Server Digest Authentication Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 37896 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2010-0387 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 21 2010 12:00AM |
| Updated: | Apr 13 2015 09:03PM |
| Credit: | Intevydis |
| Vulnerable: |
Sun Java System Web Server 6.1 SP9 Sun Java System Web Server 6.1 SP8 Sun Java System Web Server 6.1 SP7 Sun Java System Web Server 6.1 SP6 Sun Java System Web Server 6.1 SP5 Sun Java System Web Server 6.1 SP4 Sun Java System Web Server 6.1 SP3 Sun Java System Web Server 6.1 SP2 Sun Java System Web Server 6.1 SP11 Sun Java System Web Server 6.1 SP10 Sun Java System Web Server 6.1 SP1 Sun Java System Web Server 7.0 Update 7 Sun Java System Web Server 7.0 Update 6 Sun Java System Web Server 7.0 Update 3 Sun Java System Web Server 7.0 Update 2 Sun Java System Web Server 7.0 Update 1 Sun Java System Web Server 6.1 Sun Java System Web Proxy Server 4.0.12 Sun Java System Web Proxy Server 4.0.5 Sun Java System Web Proxy Server 4.0 |
| Not Vulnerable: | |
Discussion
Sun Java System Web Server Digest Authentication Remote Buffer Overflow Vulnerability
Sun Java System Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
The issues affects the following:
Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12
Sun Java System Web Proxy Server 4.0 without Service pack 13
Sun Java System Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
The issues affects the following:
Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12
Sun Java System Web Proxy Server 4.0 without Service pack 13
Exploit / POC
Sun Java System Web Server Digest Authentication Remote Buffer Overflow Vulnerability
The following example request is available:
buf = "PUT / HTTP/1.0\n"
buf += "Authorization: Digest "
buf += "ABCD,"*1000
buf += "\n\n"
The following example request is available:
buf = "PUT / HTTP/1.0\n"
buf += "Authorization: Digest "
buf += "ABCD,"*1000
buf += "\n\n"
Solution / Fix
Sun Java System Web Server Digest Authentication Remote Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Sun Java System Web Server Digest Authentication Remote Buffer Overflow Vulnerability
References:
References: