Format string vulnerability in libwebconsole_services.so in Sun Java Web Console 2.2.2 through 2.2.5 allows remote attackers to cause a denial of service (application crash), obtain sensitive information, and possibly execute arbitrary code via unspecified vectors during a failed login attempt, related to syslog.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 7.5 | HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| CWE ID | Type | Source |
|---|---|---|
| NVD-CWE-Other | Primary | nvd@nist.gov |
Root level code execution is only possible if the web console is running as root, which it does not by default.
The vendor has addressed this issue through multiple product updates: Sun Java Web Console 2.2.2 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console x86 2.2.2 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console x86 2.2.3 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console 2.2.3 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console x86 2.2.4 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console 2.2.4 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console x86 2.2.5 http://www.sun.com/download/products.xml?id=461d58be Sun Java Web Console 2.2.5 http://www.sun.com/download/products.xml?id=461d58be