ZeroBox Vulnerability Database

漏洞起因
输入验证错误
 
影响系统
Sun Java System Access Manager 6.x
Sun Java System Access Manager 7.x
 
不受影响系统
 
危害
远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。
 
攻击所需条件
攻击者必须访问Sun Java System Access Manager。
 
漏洞信息
Sun Java System Access Manager是一款安全单点登录、认证、授权解决方案。
Sun Java System Access Manager存在输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。
Sun Java System Access Manager跨域控制器存在跨站脚本漏洞，允许非特权远程用户通过Access Manager CDC注入恶意代码到WEB页，可导致类似COOKIE等信息泄漏。
 
测试方法
 
厂商解决方案
可参考如下补丁：
— SPARC Platform —
Sun Java System Access Manager 7.1 (for Solaris 8, 9 and 10):
Patch 126356-03 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-126356-03-1
Sun Java System Access Manager 7 2005Q4 (for Solaris 8, 9 and 10):
Patch 120954-09 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-120954-09-1
Sun Java System Access Manager 6 2005Q1 (for Solaris 8, 9 and 10):
Patch 119465-16 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-119465-16-1
— x86 Platform —
Sun Java System Access Manager 7.1 (for Solaris 8, 9 and 10):
Patch 126357-03 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-126357-03-1
Sun Java System Access Manager 7 2005Q4 (for Solaris 9 and 10):
Patch 120955-09 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-120955-09-1
Sun Java System Access Manager 6 2005Q1 (for Solaris 8, 9 and 10):
Patch 119465-16 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-119465-16-1
— Linux Platform —
Sun Java System Access Manager 7.1:
Patch 126358-03 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-126358-03-1
Sun Java System Access Manager 7 2005Q4:
Patch 120956-09 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-120956-09-1
Sun Java System Access Manager 6 2005Q1:
Patch 119502-16 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-119502-16-1
— Windows Platform —
Sun Java System Access Manager 7.1:
Patch 126359-03 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-126359-03-1
Sun Java System Access Manager 7 2005Q4:
Patch 124296-09 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-124296-09-1
— HP-UX —
Sun Java System Access Manager 7 2005Q4:
Patch 126371-09 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-126371-09-1
— Other —
Sun Java System Access Manager 7.1 WAR file-based installation (all platforms):
Patch 140504-03 or later.
http://sunsolve.sun.com/search/docume…setkey=urn:cds:docid:1-21-140504-03-1
 
漏洞提供者
Townsend Ladd Harris