Sun Java Web Proxy Server和Sun Java Web Server跨站脚本漏洞

BUGTRAQ ID: 26978 CNCAN ID:CNCAN-2007122401 Sun Java Web Proxy Server和Sun Java Web Server是两款基于JAVA的应用服务程序。 Sun Java Web Proxy Server和Sun Java Web Server存在输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，可获得敏感信息或任意脚本代码执行。 目前没有详细漏洞细节提供。 Sun Java Web Proxy Server 4.0.5 Sun Java Web Proxy Server 4.0.4 Sun Java Web Proxy Server 4.0.3 Sun Java Web Proxy Server 4.0.2 Sun Java Web Proxy Server 3.6 SP8 Sun Java Web Proxy Server 3.6 SP7 Sun Java Web Proxy Server 3.6 SP6 Sun Java Web Proxy Server 3.6 SP5 Sun Java Web Proxy Server 3.6 SP4 Sun Java Web Proxy Server 3.6 SP3 Sun Java Web Proxy Server 3.6 SP2 Sun Java Web Proxy Server 3.6 SP1 Sun Java Web Proxy Server 3.6 Sun Java Web Proxy Server 4.0 SP1 Sun Java Web Proxy Server 4.0 Sun Java Web Proxy Server 3.6.0 SP9 Sun Java Web Proxy Server 3.6.0 SP10 Sun Java System Web Server 6.1 SP7 Sun Java System Web Server 6.1 SP6 Sun Java System Web Server 6.1 SP5 Sun Java System Web Server 6.1 SP4 Sun Java System Web Server 6.1 SP3 Sun Java System Web Server 6.1 SP2 Sun Java System Web Server 6.1 SP1 Sun Java System Web Server 6.1 Sun Java System Web Server 6.0 SP9 Sun Java System Web Server 6.0 SP10 Sun Java System Web Server 6.0 SP8 Sun Java System Web Server 6.0 SP7 Sun Java System Web Server 6.0 SP6 Sun Java System Web Server 6.0 SP5 Sun Java System Web Server 6.0 SP4 Sun Java System Web Server 6.0 SP3 Sun Java System Web Server 6.0 SP2 Sun Java System Web Server 6.0 SP1 Sun Java System Web Server 6.0 Sun Java System Web Server 7.0 Sun Java System Web Server 6.1 厂商解决方案 可使用如下补丁： Sun Java System Web Server 6.1 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun 121524-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121524-04-1 Sun Java Web Proxy Server 4.0 Sun Sun Java System Web Proxy Server 4.0.6 <a href=http://www.sun.com/download/products.xml?id=4701e042 target=_blank>http://www.sun.com/download/products.xml?id=4701e042</a> Sun Java Web Proxy Server 4.0 SP1 Sun Sun Java System Web Proxy Server 4.0.6 <a href=http://www.sun.com/download/products.xml?id=4701e042 target=_blank>http://www.sun.com/download/products.xml?id=4701e042</a> Sun Java Web Proxy Server 3.6.0 SP10 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java System Web Server 7.0 Sun 118202-12 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -118202-12-1 Sun 125437-07 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -125437-07-1 Sun 125438-07 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -125438-07-1 Sun 125439-07 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -125439-07-1 Sun 125440-01 HU-UX <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -125440-01-1 Sun 125441-06 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -125441-06-1 Sun Java Web Proxy Server 3.6 SP2 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP5 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP1 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP7 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP4 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP6 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP3 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 3.6 SP8 Sun Sun Java System Web Proxy Server 3.6 Service Pack 11 <a href=http://www.sun.com/download/products.xml?id=472a622f target=_blank>http://www.sun.com/download/products.xml?id=472a622f</a> Sun Java Web Proxy Server 4.0.2 Sun Sun Java System Web Proxy Server 4.0.6 <a href=http://www.sun.com/download/products.xml?id=4701e042 target=_blank>http://www.sun.com/download/products.xml?id=4701e042</a> Sun Java Web Proxy Server 4.0.3 Sun Sun Java System Web Proxy Server 4.0.6 <a href=http://www.sun.com/download/products.xml?id=4701e042 target=_blank>http://www.sun.com/download/products.xml?id=4701e042</a> Sun Java Web Proxy Server 4.0.4 Sun Sun Java System Web Proxy Server 4.0.6 <a href=http://www.sun.com/download/products.xml?id=4701e042 target=_blank>http://www.sun.com/download/products.xml?id=4701e042</a> Sun Java Web Proxy Server 4.0.5 Sun Sun Java System Web Proxy Server 4.0.6 <a href=http://www.sun.com/download/products.xml?id=4701e042 target=_blank>http://www.sun.com/download/products.xml?id=4701e042</a> Sun Java System Web Server 6.0 SP9 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP10 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP6 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP1 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP7 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP5 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP4 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP8 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP3 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.0 SP2 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP4 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP1 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP2 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP3 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP6 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP7 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 SP5 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1 Sun Java System Web Server 6.1 Sun 116648-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116648-20-1 Sun 116649-20 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -116649-20-1 Sun 121510-04 <a href=http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 target=_blank>http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21</a> -121510-04-1