PT-2006-5701 · Sun · Sun Secure Global Desktop

Marc Ruef · Published 2006-09-23 · Updated 2018-10-17 · CVE-2006-4958

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Secure Global Desktop versions prior to 4.20.983

Description The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The attack vectors are unspecified but possibly involve several CGI and JSP files, including taarchives.cgi, ttaAuthentication.jsp, ttalicense.cgi, ttawlogin.cgi, ttawebtop.cgi, ttaabout.cgi, and test-cgi.

Recommendations For versions prior to 4.20.983, update to version 4.20.983 or later to resolve the issue. As a temporary workaround, consider restricting access to the potentially vulnerable CGI and JSP files until the update is applied.

Fix

Related Identifiers

CVE-2006-4958

Affected Products

Sun Secure Global Desktop

References · 13

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102650-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4958 · Security Note
• http://support.avaya.com/elmodocs2/security/ASA-2006-235.htm · Note
• http://scip.ch/cgi-bin/smss/showadvf.pl?id=2555 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29303 · Note
• http://securityfocus.com/bid/20135 · Note
• http://securityfocus.com/bid/20276 · Note
• http://securityreason.com/securityalert/1623 · Note
• http://secunia.com/advisories/22037 · Note
• http://vupen.com/english/advisories/2006/3739 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29070 · Note
• http://securitytracker.com/id?1016900 · Note
• http://securityfocus.com/archive/1/446566/100/0/threaded · Note