PT-2009-4862 · Oracle · Oracle Iplanet Web Server

Publicado 2009-07-13 · Atualizado 2011-08-29 · CVE-2009-2445

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle iPlanet Web Server versions 6.1 before SP12 Oracle iPlanet Web Server versions 7.0 through Update 6

Description The issue allows remote attackers to read arbitrary JSP files via an alternate data stream syntax. This can be demonstrated by a .jsp::$DATA URI.

Recommendations For Oracle iPlanet Web Server version 6.1, update to at least SP12 to resolve the issue. For Oracle iPlanet Web Server versions 7.0 through Update 6, update to a version later than Update 6 to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-2445

Produtos afetados

Oracle Iplanet Web Server

Referências · 10

• 🔥 http://securitytracker.com/id?1022511 · Exploit
• 🔥 http://isowarez.de/SunOne_Webserver.txt · Exploit
• http://osvdb.org/55655 · Nota
• http://vupen.com/english/advisories/2009/1786 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN47124169/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2445 · Nota de Segurança
• http://secunia.com/advisories/35701 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1 · Aviso do Fabricante
• http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2445 · Nota