Code injection via Sun's Java System Web Proxy
Sun's Java System Web Proxy, a collection of server applications, contains vulnerabilities which allow injection of malicious code. The collection includes a SOCKS server, in which crafted responses during protocol negotiation can cause buffer overflows, some of which might cause the service to crash. Because a watchdog process restarts the sockd service if it fails, attackers with access to the service can make repeated attempts to exploit the vulnerability. A valid user account is not required.
The vulnerability affects sockd in versions 4.0.4 and earlier for all platforms (Linux, Windows, HP-UX and AIX on SPARC and x86). If the SOCKS server is not required, it can simply be deactivated. Otherwise, access to the service should be restricted by means of firewall rules. In addition, Sun has released an updated version (4.0.5) of the software, in which the bug is no longer present.
- Sun Java System Web Proxy Multiple Buffer Overflow Vulnerabilities, security advisory from iDefense
- Security Vulnerabilities in the SOCKS Module of Sun Java System Web Proxy Server 4.0, bug alert from Sun
- Download the bug fixed version 4.0.5
(mba)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
