Frank Dick has reported a vulnerability in Sun Solaris and Java Web Console, which potentially can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a format string error when calling the "syslog()" function to log failed logins. This may be exploited to execute arbitrary code by logging in with specially crafted credentials.

The vulnerability is reported in Sun Solaris 10 prior to 11/06 and Sun Java Web Console versions 2.2.2 through 2.2.5.

Solution
Update to Sun Java Web Console version 2.2.6 or apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Frank Dick, n.runs AG

Original Advisory
Sun Microsystems:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102854-1

n.runs AG:
http://www.nruns.com/security_advisory_sun_java_format_string.php

Deep Links
Links available to Secunia VIM customers