PT-2006-6905 · Sun · Sun Java System Web Proxy Server+2

CVE-2006-6276 · Publicado 2006-12-04 · Atualizado 2024-02-09

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Proxy Server versions prior to 20061130

Description The issue allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches. This is achieved via unspecified attack vectors when the Sun Java System Proxy Server is used with Sun Java System Application Server or Sun Java System Web Server.

Recommendations For Sun Java System Proxy Server versions prior to 20061130, update to a version released after 20061130 to resolve the issue. As a temporary workaround, consider restricting access to sensitive web applications and implementing additional security measures to minimize the risk of web session hijacking and cross-site scripting (XSS) attacks.

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2006-6276

Produtos afetados

Sun Java System Application Server

Sun Java System Web Proxy Server

Sun Java System Web Server

Referências · 11

• http://securitytracker.com/id?1017323 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6276 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30662 · Nota
• http://securitytracker.com/id?1017324 · Nota
• http://secunia.com/advisories/23186 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1 · Correção, Aviso do Fabricante
• http://securitytracker.com/id?1017322 · Nota
• http://securityfocus.com/bid/21371 · Correção
• https://t.me/cvenotify/70730 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6276 · Nota
• http://vupen.com/english/advisories/2006/4793 · Nota