Secunia Logo
Netsikker nu! 2008
 
Sun Java System Directory Server HTTP Admin Interface Unspecified Vulnerability
Secunia Advisory: SA17092
Release Date: 2005-10-07
Last Update: 2008-03-17
Popularity: 8,843 views

Critical:
Moderately critical
Impact: System access
Where: From local network
Solution Status: Vendor Patch

Software:Sun Java System Directory Proxy Server 5.x
Sun Java System Directory Server 5.x
Sun ONE Directory Server 5.x

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference:CVE-2005-3269


Description:
Peter Winter-Smith has reported a vulnerability in Sun ONE/Sun Java System Directory Server, Sun Java System Directory Proxy Server, and Sun ONE Administration Server, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an unspecified error in the HTTP admin interface. This can be exploited to execute arbitrary code with root privileges on a vulnerable system.

The vulnerability has been reported in the following products.
* Sun Java System Directory Proxy Server 5.2
* Sun Java System Directory Server 5.2
* Sun ONE Directory Server 5.1
* Sun ONE Administration Server 5.2

Solution:
Apply patches.

-- Packaged versions of Sun ONE Administration Server 5.2 --

Solaris 8, 9, and 10 on SPARC:
Apply patch 115610-23 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-115610-23-1

Solaris 9 and 10 on x86:
Apply patch 115611-23 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-115611-23-1

Linux RHEL2.1:
Apply patch 118079-10 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-118079-10-1

-- Packaged versions of Sun Java System Directory Server 5.2 2003Q4/2004Q2/2005Q1 --

Solaris 8, 9, and 10 on SPARC:
Apply patch 115614-26 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-115614-26-1

Solaris 8, 9, and 10 on x86:
Apply patch 115615-26 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-115615-26-1

Linux:
Apply patch 118080-11 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-118080-11-1

-- Packaged versions of Sun Java System Directory Proxy Server 5.2 2003Q4/2004Q2/2005Q1 --

Solaris 8, 9, and 10 on SPARC:
Apply patch 116373-18 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-116373-18-1

Solaris 8, 9, and 10 on x86:
Apply patch 116374-14 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-116374-14-1

Linux:
Apply patch 118096-08 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-118096-08-1

-- PatchZIP version of Sun Java System Directory Server 5.2 --

For upgrade from 5.2 RTM ZIP or 5.2 Patch2 ZIP or 5.2 Patch3 ZIP.

Solaris 8, 9, and 10 on SPARC:
Apply patch 117665-03 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-117665-03-1

Solaris 8, 9 and 10 on x86:
Apply patch 117666-03 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-117666-03-1

Linux:
Apply patch 117668-03 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-117668-03-1

Windows:
Apply patch 117667-03 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-117667-03-1

HP-UX:
Apply patch 117669-03 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-117669-03-1

AIX:
Apply patch 117670-03 or later.
http://sunsolve.sun.com/search/docume...setkey=urn:cds:docid:1-21-117670-03-1

Provided and/or discovered by:
Peter Winter-Smith, NGSSoftware

Changelog:
2005-11-23: Vendor releases updated advisory. Updated "Description", "Solution" and "Original Advisory" sections.
2006-01-19: Added CVE reference.
2008-03-17: Updated "Solution" section. According to the vendor there will be no further resolutions to this issue.

Original Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102002-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-228419-1


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. phpBB Avatar Script Insertion Vulnerability // 41 views
2. phpBB Avatar Functions Information Disclosure and Deletion // 37 views
3. CUPS Multiple Vulnerabilities // 37 views
4. Sun Java System Web Proxy Server FTP Subsystem Buffer Overflow // 37 views
5. CA ARCserve Backup Multiple Vulnerabilities // 36 views
6. ScriptsEz Easy Image Downloader "id" File Disclosure Vulnerability // 34 views
7. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities // 34 views
8. phpBB reveals user IPs // 28 views
9. phpBB Cross Site Scripting and Unspecified Vulnerabilities // 27 views
10. FUJITSU Interstage Products Apache Tomcat Security Bypass // 26 views