|
Sun Java System Web Server Revoked Certificate Security Bypass
|
|
Secunia Advisory:
|
SA24531
|
|
|
Release Date:
|
2007-03-15
|
|
Last Update:
|
2007-03-26
|
|
Popularity:
|
8,193 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Sun Java System Web Server (Sun ONE/iPlanet) 6.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-1526
|
|
Description:
Sun has acknowledged a vulnerability in Sun Java System Web Server, which can be exploited by malicious users to bypass certain security restriction.
If a secure non-root server instance is set up by an admin server running as root, an unspecified error can be exploited to gain access to the web server instance using a revoked client certificate even if the server instance has a valid Certificate Revocation List (CRL) file installed.
Solution:
Install Service Pack 7 for Sun Java System Web Server 6.1 or apply patches.
-- SPARC Platform --
Install Service Pack 7 for Sun Java System Web Server 6.1 or apply patch 116648-19 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-116648-19-1
-- x86 Platform --
Install Service Pack 7 for Sun Java System Web Server 6.1 or apply patch 116649-19 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-116649-19-1
-- Linux Platform --
Install Service Pack 7 for Sun Java System Web Server 6.1 or apply patch 118202-11 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-118202-11-1
-- AIX Platform --
Install Service Pack 7 for Sun Java System Web Server 6.1.
-- HP-UX Platform --
Install Service Pack 7 for Sun Java System Web Server 6.1
Sun Java System Web Server 6.1 Service Pack 7 is available at:
http://www.sun.com/download/products.xml?id=45c90ca9
Provided and/or discovered by:
Reported by the vendor.
Changelog:
2007-03-26: Added CVE reference.
Original Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102822-1
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
