[Japanese]

JVNDB-2009-000027

Sun GlassFish Enterprise Server and Sun Java System Application Server vulnerable to cross-site scripting

Overview

Sun GlassFish Enterprise Server and Sun Java System Application Server from Sun Microsystems contain a cross-site scripting vulnerability.

Sun GlassFish Enterprise Server and Sun Java System Application Server are application servers from Sun Microsystems. Sun GlassFish Enterprise Server and Sun Java System Application Server contain a cross-site scripting vulnerability.

According to the vendor, Sun Java System Application Server is currently distributed as the open sourced Sun GlassFish Enterprise Server. Users of the Sun Java System Application Server can obtain support only if they have a support contract. For more information, refer to the vendor's website.

Please note that Sun Java System Application Server 8.x and 9.0 are not affected by this vulnerability. For more information, refer to the vendor's website.

Project VEX of UBsecure, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

Base Metrics: 2.6 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None

Affected Products


Sun Microsystems, Inc.
  • Sun GlassFish Enterprise Server v2.1 patch 1 and earlier
  • Sun Java System Application Server 9.1U2 and earlier

Impact

An arbitrary script may be executed on the user's web browser.
Solution

[Update the software]
Update to the latest version according to information provided by the vendor.
Vendor Information

Sun Microsystems, Inc.
  • Sun Alert Notification : 258528
CWE (What is CWE?)

  1. Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2009-1553
References

  1. JVN : JVN#73653977
  2. National Vulnerability Database (NVD) : CVE-2009-1553
  3. SecurityFocus : 34824
  4. VUPEN Security : VUPEN/ADV-2009-1255
  5. OPEN SOURCE VULNERABILITY DATABASE (OSVDB) : 54257
Revision History

[2009/05/13]
  Web page published