Sign-up

ID

VAR-201001-0237


CVE

CVE-2010-0360


TITLE

Sun Java System Web Server Vulnerable to overwriting the memory storage location of the heap area

Trust: 0.8

sources: JVNDB: JVNDB-2010-001074

DESCRIPTION

Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to overwrite memory locations in the heap, and discover the contents of memory locations, via a malformed HTTP TRACE request that includes a long URI and many empty headers, related to an "overflow." NOTE: this might overlap CVE-2010-0272 and CVE-2010-0273. A heap overflow vulnerability in the HTTP TRACE feature of the Java System Web server that could allow a remote, non-privileged user to cause a Web server or Web proxy server to crash, resulting in a denial of service. These vulnerabilities can also result in unauthorized access to sensitive information. Sun Java System Web Server is a Java-based WEB server. There are no detailed vulnerability details available, but the mass canvas platform already provides tools for use

Trust: 3.24

sources: NVD: CVE-2010-0360 // JVNDB: JVNDB-2010-001074 // CNVD: CNVD-2010-0166 // CNVD: CNVD-2010-0031 // BID: 79021 // BID: 37648

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2010-0166 // CNVD: CNVD-2010-0031

AFFECTED PRODUCTS

vendor:sunmodel:java system web serverscope:eqversion:7.0

Trust: 2.2

vendor:nomodel: - scope: - version: -

Trust: 1.2

vendor:sun microsystemsmodel:java system web serverscope:eqversion:7.0

Trust: 0.8

vendor:sunmodel:java system web server updatescope:eqversion:7.07

Trust: 0.6

vendor:sunmodel:java system web server sp9scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp8scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp7scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp6scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp5scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp4scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp3scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp2scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp11scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp10scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server sp1scope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web serverscope:eqversion:6.1

Trust: 0.3

vendor:sunmodel:java system web server updatescope:eqversion:7.06

Trust: 0.3

vendor:sunmodel:java system web server updatescope:eqversion:7.03

Trust: 0.3

vendor:sunmodel:java system web server updatescope:eqversion:7.02

Trust: 0.3

vendor:sunmodel:java system web server updatescope:eqversion:7.01

Trust: 0.3

vendor:sunmodel:java system web proxy serverscope:eqversion:4.0.12

Trust: 0.3

vendor:sunmodel:java system web proxy serverscope:eqversion:4.0.5

Trust: 0.3

vendor:sunmodel:java system web proxy serverscope:eqversion:4.0

Trust: 0.3

sources: NVD: CVE-2010-0360 // CNNVD: CNNVD-201001-204 // CNVD: CNVD-2010-0166 // CNVD: CNVD-2010-0031 // JVNDB: JVNDB-2010-001074 // BID: 79021 // BID: 37648

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2010-0360
value: HIGH

Trust: 1.8

CNNVD: CNNVD-201001-204
value: CRITICAL

Trust: 0.6

NVD: CVE-2010-0360
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2010-0360
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

sources: NVD: CVE-2010-0360 // CNNVD: CNNVD-201001-204 // JVNDB: JVNDB-2010-001074

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: NVD: CVE-2010-0360 // JVNDB: JVNDB-2010-001074

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201001-204

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201001-204

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2010-0360

PATCH
title:275850url:http://sunsolve.sun.com/search/document.do?assetkey=1-66-275850-1
Trust: 0.8
title:Sun-Alert-6916389: Patch for Sun Java System Web Server HTTP TRACE Remote Heap Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchinfo/show/284
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2010-0166 // 
            
            
            
            JVNDB: JVNDB-2010-001074

EXTERNAL IDS
db:NVDid:CVE-2010-0360
Trust: 3.3
db:BIDid:37648
Trust: 1.7
db:VUPENid:ADV-2010-0182
Trust: 0.8
db:JVNDBid:JVNDB-2010-001074
Trust: 0.8
db:CNNVDid:CNNVD-201001-204
Trust: 0.6
db:SECUNIAid:38260
Trust: 0.6
db:CNVDid:CNVD-2010-0166
Trust: 0.6
db:CNVDid:CNVD-2010-0031
Trust: 0.6
db:BIDid:79021
Trust: 0.3
sources:
            
            
            NVD: CVE-2010-0360 // 
            
            
            
            CNNVD: CNNVD-201001-204 // 
            
            
            
            CNVD: CNVD-2010-0166 // 
            
            
            
            CNVD: CNVD-2010-0031 // 
            
            
            
            JVNDB: JVNDB-2010-001074 // 
            
            
            
            BID: 79021 // 
            
            
            
            BID: 37648

REFERENCES
url:http://intevydis.blogspot.com/2010/01/sun-java-system-web-server-70u7-trace.html
Trust: 2.2
url:http://intevydis.com/vd-list.shtml
Trust: 1.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0360
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0360
Trust: 0.8
url:http://www.securityfocus.com/bid/37648
Trust: 0.8
url:http://www.vupen.com/english/advisories/2010/0182
Trust: 0.8
url:http://secunia.com/advisories/38260/http
Trust: 0.6
url:http://www.venustech.com.cn/newsinfo/124/5961.html
Trust: 0.6
url:http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.html
Trust: 0.3
url:http://wwws.sun.com/software/products/web_srvr/home_web_srvr.html
Trust: 0.3
url:http://sunsolve.sun.com/search/document.do?assetkey=1-66-275850-1
Trust: 0.3
sources:
            
            
            NVD: CVE-2010-0360 // 
            
            
            
            CNNVD: CNNVD-201001-204 // 
            
            
            
            CNVD: CNVD-2010-0166 // 
            
            
            
            CNVD: CNVD-2010-0031 // 
            
            
            
            JVNDB: JVNDB-2010-001074 // 
            
            
            
            BID: 79021 // 
            
            
            
            BID: 37648

CREDITS
Unknown
Trust: 0.3
sources:
            
            
            BID: 79021

SOURCES
db:NVDid:CVE-2010-0360
db:CNNVDid:CNNVD-201001-204
db:CNVDid:CNVD-2010-0166
db:CNVDid:CNVD-2010-0031
db:JVNDBid:JVNDB-2010-001074
db:BIDid:79021
db:BIDid:37648

LAST UPDATE DATE
2021-12-18T01:40:54.074000+00:00

SOURCES UPDATE DATE
db:NVDid:CVE-2010-0360date:2011-04-28T04:00:00
db:CNNVDid:CNNVD-201001-204date:2010-01-21T00:00:00
db:CNVDid:CNVD-2010-0166date:2010-01-27T00:00:00
db:CNVDid:CNVD-2010-0031date:2010-01-07T00:00:00
db:JVNDBid:JVNDB-2010-001074date:2010-02-23T00:00:00
db:BIDid:79021date:2010-01-20T00:00:00
db:BIDid:37648date:2010-01-25T19:41:00

SOURCES RELEASE DATE
db:NVDid:CVE-2010-0360date:2010-01-20T16:30:00
db:CNNVDid:CNNVD-201001-204date:2010-01-20T00:00:00
db:CNVDid:CNVD-2010-0166date:2010-01-27T00:00:00
db:CNVDid:CNVD-2010-0031date:2010-01-07T00:00:00
db:JVNDBid:JVNDB-2010-001074date:2010-02-23T00:00:00
db:BIDid:79021date:2010-01-20T00:00:00
db:BIDid:37648date:2010-01-06T00:00:00