CIA RESEARCH

Alerts

[CIA-1033-Alert] Sun Java System Application Server May Disclose JSP Source Code to Remote Users

Summary:

An unspecified vulnerability in several versions of the Sun Java System Application may allow unauthorized user to access the source code of Java Server pages.

Technical Details:

An undisclosed flaw in the following Sun Java Application Server platforms may allow an attacker to access the JSP source.

Standard Edition 7 2004Q2 Update 2 and earlier
Standard Edition 7 Update 6 and earlier
Enterprise Edition 7 2004Q2 Update 2 and earlier
Platform Edition 7 Update 6 and earlier

A disclosure if JSP source may allow an attacker to perpetrate theft of proprietary information and/or infer vulnerabilities in the application itself. Affected sites should apply the vendor supplied fix.

Consult in the individual advisories to determine if your platform in affected. BEA Weblogic server versions 6.1 SP7, 7.0 SP6, 8.1 SP4, 9.0, and others, are known to be affected by one or more of the advisories.

Solution:

Advisory 101910

CVE Reference:

GENERIC-MAP-NOMATCH

SecurityTracker Number(s):

1015047

Vendor URL:

Sun Microsystems

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic?s research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing ? that?s what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm? the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic?s customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC