PT-2007-5480 · Sun · Sun Java System Portal Server

Published 2007-08-09 · Updated 2018-10-15 · CVE-2007-4289

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Portal Server version 7.0

Description The issue arises from improper processing of XSLT stylesheets in XSLT transforms within XML signatures, allowing context-dependent attackers to execute arbitrary Java methods via a crafted stylesheet.

Recommendations For Sun Java System Portal Server version 7.0, consider restricting the use of XSLT transforms in XML signatures until a proper fix is applied. As a temporary workaround, carefully validate and sanitize all XSLT stylesheets to prevent the execution of malicious Java methods.

Fix

Related Identifiers

CVE-2007-4289

Affected Products

Sun Java System Portal Server

References · 8

• http://secunia.com/advisories/26327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4289 · Security Note
• http://isecpartners.com/advisories/2007-04-dsig.txt · Note
• http://securitytracker.com/id?1018513 · Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-103015-1 · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35811 · Note
• http://securityfocus.com/archive/1/473553/100/0/threaded · Note
• http://isecpartners.com/files/XMLDSIG_Command_Injection.pdf · Note