[NEWS] Sun Java System Web Proxy Multiple Buffer Overflow Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Sun Java System Web Proxy Multiple Buffer Overflow Vulnerabilities
------------------------------------------------------------------------

SUMMARY

Sun Microsystems Inc's Java System is "a collection of server applications
bundled together. One such server application included is the
<http://www.sun.com/software/products/web_proxy/home_web_proxy.xml > Web
Proxy Server. This software implements proxy services including HTTP and
SOCKSv5".

Remote exploitation of multiple stack-based buffer overflows in Sun
Microsystems Inc's Java System Web Proxy allows unauthenticated attackers
to execute arbitrary code with superuser privileges.

DETAILS

Vulnerable Systems:
* Sun Java Web Proxy Server version 4.0.3 (tests were performed on an x86
RedHat enterprise Linux machine).
* SPrevious versions, including products released under the "Sun ONE"
product line, are suspected to be vulnerable.

The problem specifically exists within the "sockd" daemon. This daemon
implements SOCKS proxy support for the Web Proxy product. Attackers can
cause a buffer overflow by manipulating certain bytes during protocol
negotiation.

Exploitation allows attackers to execute arbitrary code with the
privileges of the user running "sockd", typically root.

No authentication is required to trigger this vulnerability. The attacker
only needs the ability to open a session with the SOCKS server.

The server runs under a watchdog process which will restart the server in
cases when it will fail. This allows attackers to repeatedly attempt to
exploit the issue.

Workaround:
Disabling the SOCKS proxy server will prevent exploitation of this
vulnerability.
Additionally, employing firewalls to limit access to the affected service
will prevent untrusted users from exploiting this vulnerability.

Vendor Status:
Sun Microsystems has addressed these vulnerabilities in Sun Alert ID
102927. For more information visit the following URL.
<http://sunsolve.sun.com/search/document.do?assetkey=1-26-102927-1 >

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102927-1

Disclosure Timeline:
* 03/20/2007 - Initial vendor notification
* 03/22/2007 - Initial vendor response
* 05/25/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by iDefense.
The original article can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=536>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=536

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.