Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Sun Java System Web Server WEBDAV Stack Buffer Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2010-106
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory SA38260
Industry Reference(s): CVE-2010-0361
Protection Provided by: Security Gateway
  • R75
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Sun Microsystems Java System Web Server 7.0 prior to 7.0 update 8
Vulnerability Description
A buffer overflow vulnerability was reported in Sun Java System Web Server. Sun Microsystems' Java System Web Server is a web server for medium to large business applications.The vulnerability is due to a boundary error when processing crafted WEBDAV requests. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a target server. Successful exploitation could result in injection and execution of arbitrary code in the security context of the affected process.
Update/Patch Available
The vendor, Sun, has released a patch. 
Vulnerability Details
The vulnerability exists in the Sun Java System Web Server WebDAV implementation. Specifically, the vulnerability is due to insufficient boundary checks when handling specially crafted Request-Lines in a WebDAV request. Remote unauthenticated attackers can exploit this vulnerability by sending a WebDAV request, potentially causing remote code execution on the target system.

Protection Overview
This protection will detect and block HTTP requests using Webdav request methods whose URL is longer than a certain threshold.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection taband select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > IPS Software Blade > Application Intelligence > Web Servers.
2. In the right pane, double-click the Sun Java System Web Server WEBDAV Stack Buffer Overflow protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings. 
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Web Server Enforcement Violation
Attack Information: Sun Java System Web Server WEBDAV stack buffer overflow

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW 2, and select the CGI Attacks protection group.
3. Click Sun Java System Web Server WEBDAV Stack Buffer Overflow (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: WWW/CGI Attacks Protection Group
Description: Sun Java System Web Server WEBDAV Stack Buffer Overflow