ByteOS Network

NVD Vulnerability Details :

CVE-2009-2445

Analyzed

Source-cve@mitre.org

Published At-13 Jul, 2009 | 17:30

Updated At-29 Aug, 2011 | 04:00

Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:*:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp10:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp11:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp4:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp5:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp6:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp7:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp8:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>6.1

cpe:2.3:a:sun:java_system_web_server:6.1:sp9:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>7.0

cpe:2.3:a:sun:java_system_web_server:7.0:update_5:windows:*:*:*:*:*

Sun Microsystems (Oracle Corporation)

>>java_system_web_server>>7.0

cpe:2.3:a:sun:java_system_web_server:7.0:update_6:windows:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://isowarez.de/SunOne_Webserver.txt	cve@mitre.org	Exploit
http://jvn.jp/en/jp/JVN47124169/index.html	cve@mitre.org	N/A
http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069	cve@mitre.org	N/A
http://secunia.com/advisories/35701	cve@mitre.org	Vendor Advisory
http://securitytracker.com/id?1022511	cve@mitre.org	Exploit
http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1	cve@mitre.org	Vendor Advisory
http://www.osvdb.org/55655	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2009/1786	cve@mitre.org	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History