int(1205)

Vulnerability Bulletins


Acceso no autorizado en Web Server y Application Server de Sun Java System

Vulnerability classification

Property Value
Confidence level Oficial
Impact Obtener acceso
Dificulty Experto
Required attacker level Acceso remoto sin cuenta a un servicio estandar

System information

Property Value
Affected manufacturer UNIX
Affected software Sun Java System Web Server 6.1 Service Pack 2
Sun Java System Web Server 6.1 Service Pack 1
Sun Java System Application Server 7 Standard Edition Update <= 4
Sun Java System Application Server 7 Platform Edition Update <= 4
Sun Java System Application Server 7 2004Q2

Description

Existe una vulnerabilidad en Sun Java System Web Server y Sun Java System Application Server que podría permitir a un atacante remoto obtener el identificador de sesión de otro usuario.

Solution



Actualización de software

Sun
Sun Java System Application Server 7 2004Q2 Update 1
http://wwws.sun.com/software/download/products/4154c5a5.html
Sun Java System Application Server 7 Platform Edition Update 5
http://wwws.sun.com/software/download/products/4151fe59.html
Sun Java System Application Server 7 Standard Edition Update 5
http://wwws.sun.com/software/download/products/414b472d.html
Sun Java System Web Server 6.1 Service Pack 3
http://wwws.sun.com/software/download/products/415a094d.html

Standar resources

Property Value
CVE
BID

Other resources

Sun Alert Notification 57699
http://www.sunsolve.sun.com/search/document.do?assetkey=1-26-57699-1&searchclause=%22category:security%22%20%22availability,%20security%22

Version history

Version Comments Date
1.0 Aviso emitido 2004-12-16
1.1 Aviso actualizado por Sun (57699) 2005-02-11
Ministerio de Defensa
CNI
CCN
CCN-CERT