PT-2008-4382 · Sun · Sun Java System Access Manager+1

Publicado 2008-06-30 · Atualizado 2017-08-08 · CVE-2008-2945

Mitre

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-2945

Produtos afetados

Sun Java System Access Manager

Java System Identity Server

Referências · 8

• http://securityfocus.com/bid/29988 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1 · Aviso do Fabricante
• http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm · Nota
• http://securitytracker.com/id?1020380 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2945 · Nota de Segurança
• http://secunia.com/advisories/30893 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43429 · Nota
• http://vupen.com/english/advisories/2008/1967/references · Nota