PT-2001-1552 · Oracle · Iplanet Web Server Enterprise Edition

Published 2001-07-02 · Updated 2008-09-05 · CVE-2001-0327

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iPlanet Web Server Enterprise Edition versions 4.1 and earlier

Description The issue allows remote attackers to retrieve sensitive data from memory allocation pools or cause a denial of service. This is achieved via a URL-encoded Host: header in the HTTP request, which reveals memory in the Location: header returned by the server.

Recommendations For iPlanet Web Server Enterprise Edition versions 4.1 and earlier, update to a version later than 4.1 to resolve the issue.

Fix

Related Identifiers

CVE-2001-0327

Affected Products

Iplanet Web Server Enterprise Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0327 · Security Note
• http://atstake.com/research/advisories/2001/a041601-1.txt · Vendor Advisory
• http://osvdb.org/5704 · Note
• http://kb.cert.org/vuls/id/276767 · Note
• http://iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html · Note