TITLE:
Sun Solaris HTTP TRACE Response Cross-Site Scripting Issue

SECUNIA ADVISORY ID:
SA17334

VERIFY ADVISORY:
http://secunia.com/advisories/17334/

CRITICAL:
Not critical

IMPACT:
Cross Site Scripting

WHERE:
>From local network

OPERATING SYSTEM:
Sun Solaris 10
http://secunia.com/product/4813/
Sun Solaris 8
http://secunia.com/product/94/
Sun Solaris 9
http://secunia.com/product/95/

DESCRIPTION:
Sun has acknowledged a security issue in Solaris, which potentially
can be exploited by malicious people to conduct cross-site scripting
attacks.

The security issue is caused due to the Solaris Management Console
(SMC) webserver responding to HTTP TRACE requests by default. This
can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site when combined
with certain browser vulnerabilities. It is reportedly not possible
to disable the TRACE method.

The security issue has been reported in Solaris 8, 9 and 10 on both
SPARC and x86 platforms.

SOLUTION:
Apply patches when available.

The vendor recommends that the SMC may be disabled as a workaround.

-- SPARC Platform --

Solaris 9:
Apply patch 116807-02 or later.

-- x86 Platform --

Solaris 9:
Apply patch 116808-02 or later.

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------