CVE-2008-2945: Input Validation
First published: Mon Jun 30 2008(Updated: )
Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun Java System Identity Server | =6.2 | |
| Sun Java System Access Manager | =7.1 | |
| Sun Java System Access Manager | =6.3 | |
| Sun Java System Identity Server | =6.1 | |
| Sun Java System Access Manager | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1
- http://www.securitytracker.com/id?1020380
- http://www.securityfocus.com/bid/29988
- http://secunia.com/advisories/30893
- http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm
- http://www.vupen.com/english/advisories/2008/1967/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43429
Frequently Asked Questions
What is the severity of CVE-2008-2945?
CVE-2008-2945 has a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2008-2945?
To fix CVE-2008-2945, update to the latest versions of Sun Java System Access Manager and Sun Java System Identity Server.
What versions are affected by CVE-2008-2945?
CVE-2008-2945 affects Sun Java System Access Manager versions 6.3 to 7.1 and Sun Java System Identity Server versions 6.1 and 6.2.
Can CVE-2008-2945 be exploited remotely?
Yes, CVE-2008-2945 can be exploited by context-dependent attackers, enabling remote code execution.
What types of attacks are possible with CVE-2008-2945?
CVE-2008-2945 allows attackers to execute arbitrary code via crafted XSLT stylesheets.
- collector/nvd-historical
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/sun
- canonical/sun java system identity server
- version/sun java system identity server/6.2
- canonical/sun java system access manager
- version/sun java system access manager/7.1
- version/sun java system access manager/6.3
- version/sun java system identity server/6.1
- version/sun java system access manager/7.0