Sun Microsystems has issued service packs to fix bugs in
the search function of its iPlanet Web server.
The buffer overrun vulnerabilities, detected by Next Generation Security
Software (NGSS), affects versions 4.1 and 6.0 of iPlanet. The flaw could
allow a remote attacker to run arbitrary code if the search function within
the Server is enabled. It is described as a high-risk bug.
By default, the vulnerable search function is turned off but, if enabled,
NGSS found that the iPlanet server is vulnerable to a remotely exploitable
buffer overrun.
By supplying an overly long value for the ‘NS-rel-doc-name’ parameter a
saved return address is overwritten on the stack, giving control over the
vulnerable process’ execution. Any code supplied will run in the security
context of the account running the web server.
On Windows NT/2000, for example, this account is the local SYSTEM account,
by default, so any code will run uninhibited, NGSS warned.
Service packs have been issued at Sun’s Web
site. Users of iPlanet Web Server 6 should install Service Pack 3 and
4.1 users should install Service Pack 10.
The iPlanet Web server bug comes on the heels of a chunk handling
vulnerability in versions of the open-source Apache Web server that
could cause denial-of-service attacks or allow an attacker to take remote
control of a server.
The detection of that bug, which harms Web servers based on Apache code
versions 1.3 through 1.3.24 and versions 2.0 through 2.0.36, has created bad
blood in the software security space with Apache officials upset they
weren’t first notified before the ISS issued its advisory and patch. “We
were also notified today by ISS that they had published the same issue which
has forced the early release of this advisory,” the Foundation said.
Security experts have spent the last few weeks attempting to decode a worm
that has been discovered
exploiting the Apache flaw.
