Freely subscribe to our NEWSLETTER

SYNTHESIS OF THE VULNERABILITY

Three vulnerabilities of Sun Java System Calendar Server can be
used by an attacker to create a two Cross Site Scripting and a
denial of service.

Severity: 2/4

Consequences: client access/rights, denial of service of service

Provenance: document

Means of attack: 3 attacks

Ability of attacker: beginner (1/4)

Confidence: confirmed by the editor (5/5)

Diffusion of the vulnerable configuration: high (3/3)

Number of vulnerabilities in this bulletin: 3

Creation date: 01/04/2009

IMPACTED PRODUCTS
– Sun Java System Calendar Server
– Sun ONE Calendar Server

DESCRIPTION OF THE VULNERABILITY

Three vulnerabilities were annonced in Sun Java System Calendar
Server.

The "Fmt-out" parameter of the https://server:3443/login.wcap page
is not filtered before being displayed, which leads to a Cross
Site Scripting. [grav:2/4; 256228, 6793984, BID-34152,
CVE-2009-1218]

The "date" parameter of the https://server:3443/command.shtml page
is not filtered before being displayed, which leads to a Cross
Site Scripting. [grav:2/4; 256228, 6793984, BID-34153,
CVE-2009-1218]

When the attacker uses the "tzid" parameter twice, the web server
stops. [grav:2/4; 255008, 6728790, BID-34150, CVE-2009-1219]

CHARACTERISTICS

Identifiers: 255008, 256228, 6728790, 6793984, BID-34150,
BID-34152, BID-34153, CORE-2009-0108, CVE-2009-1218,
CVE-2009-1219, VIGILANCE-VUL-8581

http://vigilance.fr/vulnerability/Sun-Java-System-Calendar-three-vulnerabilities-8581