PT-2006-6905 · Sun · Sun Java System Web Proxy Server+2

Published 2006-12-04 · Updated 2024-02-09 · CVE-2006-6276

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Proxy Server versions prior to 20061130

Description The issue allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches. This is achieved via unspecified attack vectors when the Sun Java System Proxy Server is used with Sun Java System Application Server or Sun Java System Web Server.

Recommendations For Sun Java System Proxy Server versions prior to 20061130, update to a version released after 20061130 to resolve the issue. As a temporary workaround, consider restricting access to sensitive web applications and implementing additional security measures to minimize the risk of web session hijacking and cross-site scripting (XSS) attacks.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2006-6276

Affected Products

Sun Java System Application Server

Sun Java System Web Proxy Server

Sun Java System Web Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-6276 · Security Note
• http://securityfocus.com/bid/21371 · Patch
• http://securitytracker.com/id?1017323 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30662 · Note
• http://securitytracker.com/id?1017324 · Note
• http://secunia.com/advisories/23186 · Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1 · Patch, Vendor Advisory
• http://securitytracker.com/id?1017322 · Note
• https://t.me/cvenotify/70730 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6276 · Note
• http://vupen.com/english/advisories/2006/4793 · Note