Vulnerability Bulletins |
Cross-site scripting en Sun Java System Messaging Server |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Comercial Software |
| Affected software |
Sun Java System Messaging Server 6.0 Sun Java System Messaging Server 6.3 |
Description |
|
|
Se ha encontrado una vulnerabilidad del tipo cross-site scripting en Sun Java System Messenger Express en la función errorHTML en el script index. La causa reside en un error no especificado. Un atacante remoto podría inyectar código web script o HTML de forma arbitraria mediante el parámetro de error. |
|
Solution |
|
|
Actualización de software Sun(102909) Sun Java System Messaging Server 6.x / SPARC / Solaris 9 / Solaris 10 / patch 120228-20 http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-120228-20-1 Sun Java System Messaging Server 6.x / x86 / Solaris 9 / Solaris 10 / patch 120229-18 Sun Java System Messaging Server 6.x / x86 / RHEL 3 / RHEL 4 / patch 120230-18 http://sunsolve.sun.com/pub-cgi/show.pl?target=patchpage |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2006-5653 |
| BID | 20832 |
Other resources |
|
|
Sun Alert Notification (102909) http://sunsolve.sun.com/search/document.do?assetkey=1-26-102909-1 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2007-05-24 |
| 1.1 | Aviso actualizado por Sun (102909) | 2007-05-31 |