Critical vulnerabilities in Sun Calendar Express

Core Security Technologies has issued an advisory disclosing critical vulnerabilities that could affect large numbers of end users and organizations using Sun’s Java System Calendar Express web server software.

CoreLabs unearthed multiple vulnerabilities in Sun’s Calendar Express scheduling software, a remote access element of Sun’s Java Communications Suite, which, if compromised, could allow attackers to target users of the technology through both cross-site scripting (XSS) and denial-of-service (DoS) campaigns.

Upon making the discoveries, CoreLabs immediately alerted the Sun Security Coordination Team to the vulnerabilities and the two companies have since synchronized efforts to ensure that patches could be created and made available to protect users of the program.

Sun’s Calendar Express technology is aimed primarily at organizations seeking to offer their users remote access to internal scheduling and messaging tools. This leads CoreLabs researchers to believe that any attackers who become familiar with the reported vulnerabilities could potentially use the flaws to get their hands on sensitive business or personal data or to take systems offline via DoS.

The XSS issues uncovered by researchers in Sun Calendar Express reside in the product’s login page and another URL, while the DoS vulnerability could be compromised by simply requesting data from a certain URL twice.

Vulnerability details

CoreLabs security researchers found multiple XSS vulnerabilities and a single DoS vulnerability in Java System Calendar Express web server, with the XSS flaws located specifically in two individual URLs, and the DoS vulnerability in a third URL.

In the case of the first XSS vulnerability, which affects the login page of the Sun Java System Calendar Express web application, the affected URL is originally accessed through a POST request and can be exploited both with a GET and with a POST request. The contents of the variables involved in a potential attack are not encoded at the time of using them in HTML output, therefore allowing an attacker who controls their content to insert JavaScript code.

In the second XSS vulnerability, the contents of the affected URL’s date variable are not encoded at the time they are used in HTML output, therefore allowing an attacker who controls their contents to insert JavaScript code. Other fields on this or other pages for this application could also be vulnerable to the same type of issue.

Regarding the DoS vulnerability, an attacker can crash the Sun Java System Calendar Express web server by simply requesting data from a specific URL twice. Such a crash can in fact be touched off using any string of alphabetic characters. The first time the data is entered the attacker will receive an error. Entering the data a second time will cause the server to cease responding until the administrator restarts the process.

For more information on this vulnerability, please view the CORE-2009-0108 security advisory.