PT-2000-1563 · Sun · Sun Java Web Server

Publicado 2000-07-12 · Atualizado 2008-09-10 · CVE-2000-0629

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java web server versions 2.0 and earlier

Description The default configuration of the Sun Java web server allows remote attackers to execute arbitrary commands. This is achieved by uploading Java code to the server via "board.html", then directly calling the JSP compiler servlet.

Recommendations For Sun Java web server versions 2.0 and earlier, consider disabling the JSP compiler servlet as a temporary workaround until a patch is available. Restrict access to the "board.html" page to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2000-0629

Produtos afetados

Sun Java Web Server

Referências · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2000-07/0163.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0629 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0629 · Nota
• http://sun.com/software/jwebserver/faq/jwsca-2000-02.html · Aviso do Fabricante
• http://securityfocus.com/bid/1459 · Nota