PT-2007-5480 · Sun · Sun Java System Portal Server

Publicado 2007-08-09 · Atualizado 2018-10-15 · CVE-2007-4289

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Portal Server version 7.0

Description The issue arises from improper processing of XSLT stylesheets in XSLT transforms within XML signatures, allowing context-dependent attackers to execute arbitrary Java methods via a crafted stylesheet.

Recommendations For Sun Java System Portal Server version 7.0, consider restricting the use of XSLT transforms in XML signatures until a proper fix is applied. As a temporary workaround, carefully validate and sanitize all XSLT stylesheets to prevent the execution of malicious Java methods.

Correção

Identificadores relacionados

CVE-2007-4289

Produtos afetados

Sun Java System Portal Server

Referências · 8

• http://isecpartners.com/advisories/2007-04-dsig.txt · Nota
• http://securitytracker.com/id?1018513 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-103015-1 · Correção, Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35811 · Nota
• http://securityfocus.com/archive/1/473553/100/0/threaded · Nota
• http://secunia.com/advisories/26327 · Aviso do Fabricante
• http://isecpartners.com/files/XMLDSIG_Command_Injection.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4289 · Nota de Segurança