Vulnerabilities > CVE-2005-3269 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in SUN products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Stack-based buffer overflow in help.cgi in the HTTP administrative interface for (1) Sun Java System Directory Server 5.2 2003Q4, 2004Q2, and 2005Q1, (2) Red Hat Directory Server and (3) Certificate Server before 7.1 SP1, (4) Sun ONE Directory Server 5.1 SP4 and earlier, and (5) Sun ONE Administration Server 5.2 allows remote attackers to cause a denial of service (admin server crash), or local users to gain root privileges.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 20 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_115611.NASL description Sun Java(TM) System Administration Server 5.2 patch 6: Solaris_x86. Date this patch was last updated by Sun : Sep/21/07 This plugin has been deprecated and either replaced with individual 115611 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22978 published 2006-11-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22978 title Solaris 10 (x86) : 115611-25 (deprecated) NASL family Solaris Local Security Checks NASL id SOLARIS8_115610.NASL description Sun Java(TM) System Administration Server 5.2 patch 6: Solaris spa. Date this patch was last updated by Sun : Sep/21/07 last seen 2020-06-01 modified 2020-06-02 plugin id 23371 published 2006-11-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23371 title Solaris 8 (sparc) : 115610-25 NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_115615.NASL description Sun Java(TM) System Directory Server 5.2 patch 6 : Solaris_x86. Date this patch was last updated by Sun : Sep/21/07 This plugin has been deprecated and either replaced with individual 115615 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22979 published 2006-11-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22979 title Solaris 10 (x86) : 115615-28 (deprecated) NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_115611.NASL description Sun Java(TM) System Administration Server 5.2 patch 6: Solaris_x86. Date this patch was last updated by Sun : Sep/21/07 last seen 2020-06-01 modified 2020-06-02 plugin id 23580 published 2006-11-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23580 title Solaris 9 (x86) : 115611-25 NASL family Solaris Local Security Checks NASL id SOLARIS8_115614.NASL description Sun Java(TM) System Directory Server 5.2 patch 6 : Solaris sparc. Date this patch was last updated by Sun : Sep/21/07 last seen 2020-06-01 modified 2020-06-02 plugin id 23372 published 2006-11-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23372 title Solaris 8 (sparc) : 115614-28 NASL family Solaris Local Security Checks NASL id SOLARIS10_115610.NASL description Sun Java(TM) System Administration Server 5.2 patch 6: Solaris spa. Date this patch was last updated by Sun : Sep/21/07 This plugin has been deprecated and either replaced with individual 115610 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22943 published 2006-11-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22943 title Solaris 10 (sparc) : 115610-25 (deprecated) NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_115615.NASL description Sun Java(TM) System Directory Server 5.2 patch 6 : Solaris_x86. Date this patch was last updated by Sun : Sep/21/07 last seen 2020-06-01 modified 2020-06-02 plugin id 23581 published 2006-11-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23581 title Solaris 9 (x86) : 115615-28 NASL family Solaris Local Security Checks NASL id SOLARIS9_115614.NASL description Sun Java(TM) System Directory Server 5.2 patch 6 : Solaris sparc. Date this patch was last updated by Sun : Sep/21/07 last seen 2020-06-01 modified 2020-06-02 plugin id 23508 published 2006-11-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23508 title Solaris 9 (sparc) : 115614-28 NASL family Solaris Local Security Checks NASL id SOLARIS10_115614.NASL description Sun Java(TM) System Directory Server 5.2 patch 6 : Solaris sparc. Date this patch was last updated by Sun : Sep/21/07 This plugin has been deprecated and either replaced with individual 115614 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22944 published 2006-11-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22944 title Solaris 10 (sparc) : 115614-28 (deprecated) NASL family Solaris Local Security Checks NASL id SOLARIS9_115610.NASL description Sun Java(TM) System Administration Server 5.2 patch 6: Solaris spa. Date this patch was last updated by Sun : Sep/21/07 last seen 2020-06-01 modified 2020-06-02 plugin id 23507 published 2006-11-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23507 title Solaris 9 (sparc) : 115610-25
References
- http://marc.info/?l=bugtraq&m=112862037500012&w=2
- http://marc.info/?l=bugtraq&m=112862037500012&w=2
- http://marc.info/?l=bugtraq&m=113815459026080&w=2
- http://marc.info/?l=bugtraq&m=113815459026080&w=2
- http://secunia.com/advisories/17092
- http://secunia.com/advisories/17092
- http://secunia.com/advisories/18590
- http://secunia.com/advisories/18590
- http://securityreason.com/securityalert/367
- http://securityreason.com/securityalert/367
- http://securityreason.com/securityalert/51
- http://securityreason.com/securityalert/51
- http://securitytracker.com/id?1015014
- http://securitytracker.com/id?1015014
- http://securitytracker.com/id?1015536
- http://securitytracker.com/id?1015536
- http://securitytracker.com/id?1015537
- http://securitytracker.com/id?1015537
- http://securitytracker.com/id?1015538
- http://securitytracker.com/id?1015538
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-117665-03-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-117665-03-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102002-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102002-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-228419-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-228419-1
- http://www.securityfocus.com/bid/15013
- http://www.securityfocus.com/bid/15013
- http://www.securityfocus.com/bid/16345
- http://www.securityfocus.com/bid/16345
- http://www.vupen.com/english/advisories/2005/1988
- http://www.vupen.com/english/advisories/2005/1988
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24311
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24311