Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Sun Java System Web Server Digest Authorization Buffer Overflow

Subscribe

Check Point Reference: CPAI-2010-109
Date Published:
Severity:
Source: BugTraq ID: 37896
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Sun Microsystems Java System Web Proxy Server 4.0 prior to SP13
Sun Microsystems Java System Web Server 6.1 prior to SP12
Sun Microsystems Java System Web Server 7.0 prior to Update Release 8
Vulnerability Description
A buffer overflow vulnerability was reported in Sun Java System Web Server, a web server for medium to large business applications. The vulnerability is due to insufficient boundary checks when processing malformed HTTP requests. A remote unauthenticated attack can leverage this vulnerability by sending a crafted HTTP request to a target server. Successful exploitation could lead to execution of remote code.
Update/Patch Available
The vendor, Sun, has provided a patch.
Vulnerability Details
The vulnerability is due to a boundary error while parsing specially crafted headers in an HTTP PUT request. Remote unauthenticated attackers can exploit this vulnerability by sending a crafted HTTP PUT request, potentially leading to remote code execution.

Protection Overview

This protection will detect and block HTTP requests with too many Digest Authentication headers.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW 2, and select the Strict Compliance protection group.
3. Click Too many Digest Authorization key/value pairs (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon attack, the following entries will be logged:

Alert Name: HTTP Compliance
Description: Too many Digest Authorization key/value pairs