Overview
» IDS/IPS Signatures
Security Sites
iPolicy Networks Security Advisory
 

Sun Java Web Server TRACE Request Heap Buffer Overflow Vulnerability
Date Discovered: 01/20/2009
Severity: High
Applications Affected: Sun Java System Web Server 7.0
Type: Remote
Identifiers: CVE-2010-0360
Synopsis
Sun Java System Web Server is prone to remote heap-based buffer overflow vulnerability, which could be exploited to cause heap-based buffer overflow in security context of logged-in user.
Recommended Actions
Allow only trusted users.
Threat Analysis
Sun Java System Web Server is a web server intended for average and huge business applications. It provides the most scalable, high-performance, flexibility and supports a variety of applications.

Sun Java System Web Server is prone to remote heap-based buffer overflow vulnerability. This vulnerability exists via malformed long URI in TRACE HTTP method. Successful exploitation allows remote attackers to overwrite memory locations in the heap, and discover the contents of memory locations.
References

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0360
http://intevydis.com/vd-list.shtml

Write-up by: Gaurav Bajpai