PT-2009-4862 · Oracle · Oracle Iplanet Web Server

Published 2009-07-13 · Updated 2011-08-29 · CVE-2009-2445

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle iPlanet Web Server versions 6.1 before SP12 Oracle iPlanet Web Server versions 7.0 through Update 6

Description The issue allows remote attackers to read arbitrary JSP files via an alternate data stream syntax. This can be demonstrated by a .jsp::$DATA URI.

Recommendations For Oracle iPlanet Web Server version 6.1, update to at least SP12 to resolve the issue. For Oracle iPlanet Web Server versions 7.0 through Update 6, update to a version later than Update 6 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-2445

Affected Products

Oracle Iplanet Web Server

References · 10

• 🔥 http://securitytracker.com/id?1022511 · Exploit
• 🔥 http://isowarez.de/SunOne_Webserver.txt · Exploit
• http://vupen.com/english/advisories/2009/1786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2445 · Security Note
• http://secunia.com/advisories/35701 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1 · Vendor Advisory
• http://osvdb.org/55655 · Note
• http://jvn.jp/en/jp/JVN47124169/index.html · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2445 · Note