PT-2007-2916 · Sun · Sun Java System Web Server

Published 2007-03-20 · Updated 2011-03-08 · CVE-2007-1526

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Web Server version 6.1 before 20070314

Description The issue allows remote authenticated users with revoked client certificates to bypass the Certificate Revocation List (CRL) authorization control. This enables access to secure web server instances running under an account different from that used for the admin server.

Recommendations For Sun Java System Web Server version 6.1 before 20070314, update to a version released after 20070314 to resolve the issue.

Fix

Related Identifiers

CVE-2007-1526

Affected Products

Sun Java System Web Server

References · 7

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102822-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1526 · Security Note
• http://secunia.com/advisories/24531 · Note
• http://vupen.com/english/advisories/2007/0958 · Note
• http://osvdb.org/34074 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1526 · Note
• http://securitytracker.com/id?1017777 · Note