A vulnerability has been discovered in Sun Java System Web Server, which can be exploited by malicious people to gain knowledge of potentially sensitive information.

The vulnerability is caused due to an error when handling requests for Java Server pages and can be exploited to disclose the contents of JSP resources by appending "::$DATA" to the file extension.

The vulnerability is confirmed in versions 6.1 SP10, 6.1 SP11, and 7.0 Update 5 for Windows. Other versions may also be affected.

Solution
Apply the workaround recommended by the vendor (see the vendor advisory for details).

Provided and/or discovered by
Nikolaos Rangos

Changelog
Further details available in Customer Area

Original Advisory
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266429-1

Nikolaos Rangos:
http://isowarez.de/SunOne_Webserver.txt

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area