Sun Java System Web Proxy Server buffer overflow
| sun-web-proxy-bo (17920) |  High Risk |
Description:
Sun Java System Web Proxy Server (formerly Sun ONE Web Proxy Server) is vulnerable to a buffer overflow. A remote unprivileged user could exploit this vulnerability to overflow a buffer and execute arbitrary code on the server or cause the server to crash.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of Sun Java System Web Proxy Server (3.6 Service Pack 6 or later), as listed in Sun Alert ID: 57606. See References.
References:
- CIAC Information Bulletin P-027: Sun Java System Web Proxy Server Buffer Overflow Vulnerability.
- Sun Alert ID: 57606: Buffer Overflow Vulnerabilities in Sun Java System Web Proxy Server .
- Sun Microsystems, Inc. Web site: Sun Java System Web Proxy Server 3.6 Service Pack 6.
- BID-11566: Sun Java System Web Proxy Server Multiple Unspecified Buffer Overflow Vulnerabilities
- CVE-2004-1350: Multiple buffer overflows in Sun Java System Web Proxy Server (formerly Sun ONE Proxy Server) 3.6 through 3.6 SP4 allow remote attackers to execute arbitrary code via unknown vectors, possibly CONNECT requests.
- OSVDB ID: 11304: Sun Java System Web Proxy Server Overflow
- SA13036: Sun Java System Web Proxy Server Unspecified Buffer Overflows
- SECTRACK ID: 1012005: Sun Java System Web Proxy Server Buffer Overflow May Let Remote Users Execute Arbitrary Code
- US-CERT VU#964401: Sun Java System Web Proxy Server vulnerable to buffer overflow
Platforms Affected:
- HP HP-UX 11.0.4
- HP HP-UX 11.00
- HP HP-UX 11.04
- HP HP-UX 11.10
- HP HP-UX 11.11
- HP HP-UX 11.11i
- HP HP-UX 11.2
- HP HP-UX 11.20
- HP HP-UX 11.22
- HP HP-UX 11.23
- HP HP-UX 11.31
- HP HP-UX 11.4
- IBM AIX 4.3.3
- Sun Java Web Proxy Server 3.6 SP3
- Sun Java Web Proxy Server 3.6 SP2
- Sun Java Web Proxy Server 3.6 SP4
- Sun Java Web Proxy Server 3.6 SP1
- Sun Java Web Proxy Server 3.6
- Sun Solaris 2.6
- Sun Solaris 8
- Sun Solaris 9
Reported:
Oct 29, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net