Security Vulnerabilities in Sun Java System Access Manager Policy Agent 2.2 (Web Agents) May Cause Denial of Service (DoS)

---

Security Vulnerabilities in Sun Java System Access Manager Policy Agent 2.2 (Web Agents) May Cause Denial of Service (DoS)

1. Impact

Security vulnerabilities in Sun Java System Access Manager Policy Agent 2.2 (Web Agents) may allow a local or remote user to cause a Denial of Service (DoS) to the Policy Agent in the form of a program crash or an infinite loop, or possibly to execute arbitrary code by sending crafted XML documents.

These issues are related to the vulnerabilities which are described in the following documents:


2. Contributing Factors

These issues can occur in the following releases for all supported platforms:

• Sun Java System Access Manager Policy Agent 2.2 for Apache 2.0.54 without patch 141243-01
• Sun Java System Access Manager Policy Agent 2.2 for Apache 2.2.9 without patch 141244-01
• Sun Java System Access Manager Policy Agent 2.2 for Domino Server 6.5/7.0/8.0 without patch 141245-01
• Sun Java System Access Manager Policy Agent 2.2 for Microsoft IIS 5.0 without patch 141246-01
• Sun Java System Access Manager Policy Agent 2.2 for Microsoft IIS 6.0 without patch 141247-01
• Sun Java System Access Manager Policy Agent 2.2 for Sun Java System Web Proxy Server 4.0 without patch 141248-01
• Sun Java System Access Manager Policy Agent 2.2 for Sun Java System Web Server 6.1 without patch 141249-01
• Sun Java System Access Manager Policy Agent 2.2 for Sun Java System Web Server 7.0 without patch 141250-01

For details on how to determine the version of Sun Java System Access Manager Policy Agent on a system, see the "Sun Java System Access Manager Policy Agent 2.2 Release Notes" at:


3. Symptoms

There are no predictable symptoms that would indicate the described issues have been exploited.

4. Workaround

There is no workaround for these issues. Please see the Resolution section below.

5. Resolution

These issues are addressed in the following releases for all supported platforms:

• Sun Java System Access Manager Policy Agent 2.2 for Apache 2.0.54 with patch 141243-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Apache 2.2.9 with patch 141244-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Domino Server 6.5/7.0/8.0 with patch 141245-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Microsoft IIS 5.0 with patch 141246-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Microsoft IIS 6.0 with patch 141247-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Sun Java System Web Proxy Server 4.0 with patch 141248-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Sun Java System Web Server 6.1 with patch 141249-01 or later
• Sun Java System Access Manager Policy Agent 2.2 for Sun Java System Web Server 7.0 with patch 141250-01 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.




Attachments

This solution has no attachment