Critical vulnerabilities in Sun Calendar Express
Core Security Technologies has issued an advisory disclosing critical vulnerabilities that could affect large numbers of end users and organizations using Sun’s Java System Calendar Express web server software.
CoreLabs unearthed multiple vulnerabilities in Sun’s Calendar Express scheduling software, a remote access element of Sun’s Java Communications Suite, which, if compromised, could allow attackers to target users of the technology through both cross-site scripting (XSS) and denial-of-service (DoS) campaigns.
Upon making the discoveries, CoreLabs immediately alerted the Sun Security Coordination Team to the vulnerabilities and the two companies have since synchronized efforts to ensure that patches could be created and made available to protect users of the program.
Sun’s Calendar Express technology is aimed primarily at organizations seeking to offer their users remote access to internal scheduling and messaging tools. This leads CoreLabs researchers to believe that any attackers who become familiar with the reported vulnerabilities could potentially use the flaws to get their hands on sensitive business or personal data or to take systems offline via DoS.
The XSS issues uncovered by researchers in Sun Calendar Express reside in the product’s login page and another URL, while the DoS vulnerability could be compromised by simply requesting data from a certain URL twice.
CoreLabs security researchers found multiple XSS vulnerabilities and a single DoS vulnerability in Java System Calendar Express web server, with the XSS flaws located specifically in two individual URLs, and the DoS vulnerability in a third URL.
Regarding the DoS vulnerability, an attacker can crash the Sun Java System Calendar Express web server by simply requesting data from a specific URL twice. Such a crash can in fact be touched off using any string of alphabetic characters. The first time the data is entered the attacker will receive an error. Entering the data a second time will cause the server to cease responding until the administrator restarts the process.
For more information on this vulnerability, please view the CORE-2009-0108 security advisory.