----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Sun Java System Active Server Pages Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA30523

VERIFY ADVISORY:
http://secunia.com/advisories/30523/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Manipulation of data, Exposure of system
information, Exposure of sensitive information, System access

WHERE:
>From remote

SOFTWARE:
Sun Java System Active Server Pages 4.x
http://secunia.com/product/15769/

DESCRIPTION:
Some vulnerabilities and a security issue have been reported in Sun
Java System Active Server Pages, which can be exploited by malicious
users to compromise a vulnerable system, and by malicious people to
disclose sensitive information, manipulate certain data, bypass
certain security restrictions, or to compromise a vulnerable system.

1) Input passed to an unspecified file included by various ASP
applications is not properly verified before being used within a
function to create files. This can be exploited to create or append
to arbitrary files on the system.

2) A security issue is caused due to password and configuration data
being stored within the application server root directory. This can
be exploited to disclose sensitive information, e.g. configuration
data or password hashes.

3) An input validation error exists within unspecified ASP
applications, which can be exploited to disclose the content of
arbitrary files or delete arbitrary files via specially crafted HTTP
requests containing directory traversal sequences.

Successful exploitation of vulnerabilities #1 to #3 requires network
access to the administration server (port 5100/TCP).

4) A boundary error exists in the handling of request within the ASP
server, which can be exploited to cause a stack-based buffer overflow
via a specially crafted request.

Successful exploitation allows execution of arbitrary code.

5) Various input to unspecified ASP applications is not properly
sanitised before being used to execute shell commands. This can be
exploited to inject and execute arbitrary shell commands via
specially crafted HTTP requests containing shell meta-characters.

Successful exploitation requires authenticated access to the
administration server (but see #6).

6) A design error can be exploited to bypass the authentication of
the administration HTTP server by sending specially crafted requests
to port 5102/TCP.

The vulnerabilities are reported in version 4.0.2. Other versions may
also be affected.

SOLUTION:
Update to version 4.0.3
https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_SMI-Site/en_US/-/USD/ViewProductDetail-Start?ProductRef=SJASP-4.0.3-OTH-G-TP@CDS-CDS_SMI

PROVIDED AND/OR DISCOVERED BY:
1-6) An anonymous person, reported via iDefense
5) Joshua J. Drake, iDefense Labs

ORIGINAL ADVISORY:
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238184-1

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=705
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=706
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=707
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=708
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=709
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=710

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------