----------------------------------------------------------------------


  Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management

http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Sun Java Communications Suite Convergence Component Two
Vulnerabilities

SECUNIA ADVISORY ID:
SA39430

VERIFY ADVISORY:
http://secunia.com/advisories/39430/

DESCRIPTION:
Two vulnerabilities have been reported in Sun Java Communications
Suite, which can be exploited by malicious users to conduct script
insertion attacks and manipulate certain data.

1) Certain input passed when creating the name of a mail folder is
not properly sanitised before being used. This can be exploited to
insert arbitrary HTML and script code, which will be executed in a
user's browser session in context of an affected site when the
malicious data is being viewed.

2) An unspecified error in the Address Book and Mail Filter component
can be exploited to inject custom XML files. No further information is
currently available.

The vulnerabilities are reported in version 1.0.

SOLUTION:
Apply patches.

-- SPARC Platform --

Sun Convergence 1.0:
Apply patch 137631-12 or later.


-- x86 Platform --

Sun Convergence 1.0:
Apply patch 137632-12 or later.


-- Linux Platform --

Sun Convergence 1.0:
Apply patch 137633-12 or later.

PROVIDED AND/OR DISCOVERED BY:
It is currently unclear who reported these vulnerabilities as the
Oracle Critical Patch Update for April 2010 only provides a bundled
list of credits. This section will be updated when/if the original
reporter provides more information.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-276090-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-276411-1
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------