----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
Sun Java System Web / Application Server XSLT Processing
Vulnerability

SECUNIA ADVISORY ID:
SA26023

VERIFY ADVISORY:
http://secunia.com/advisories/26023/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Privilege escalation

WHERE:
Local system

SOFTWARE:
Sun Java System Web Server 7.x
http://secunia.com/product/14474/
Sun Java System Application Server 8.x
http://secunia.com/product/3509/
Sun Java System Application Server 9.x
http://secunia.com/product/14755/

DESCRIPTION:
A vulnerability has been reported in Sun Java System Web Server and
Application Server, which can be exploited by malicious, local users
to perform actions with escalated privileges.

The vulnerability is caused due to an unspecified error in the
processing of XSLT stylesheets contained in XSLT Transforms in XML
Signatures. This can be exploited to execute arbitrary Java methods
via a malicious XSLT stylesheet.

For affected products and versions please see the vendor's advisory
for details.

SOLUTION:
Update to the latest version:

A final resolution is pending completion for Sun Java System
Application Server Platform Edition 9.0.

-- SPARC Platform --

Sun Java System Web Server 7.0 with Update 1 or later.
http://www.sun.com/download/products.xml?id=467713d6

Sun Java System Application Server Platform Edition 8.2 with
file-based patch 124679-01 or SVR4 patch 124672-02 or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124679-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124672-02-1

Sun Java System Application Server Enterprise Edition 8.2 with
file-based patch 124675-01 or SVR4 patch 124672-02 or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124675-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124672-02-1


-- x86 Platform-- 

Sun Java System Web Server 7.0 with Update 1 or later:
http://www.sun.com/download/products.xml?id=467713d6

Sun Java System Application Server Platform Edition 8.2 with
file-based patch 124680-01 or SVR4 patch 124673-02 or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124680-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124673-02-1

Sun Java System Application Server Enterprise Edition 8.2 with
file-based patch 124676-01 or SVR4 patch 124673-02 or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124676-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124673-02-1


-- Linux --

Sun Java System Web Server 7.0 with Update 1 or later:
http://www.sun.com/download/products.xml?id=467713d6

Sun Java System Application Server Platform Edition 8.2 with
file-based patch 124681-01 or RHEL3.0/RHEL4.0 (Pkg_patch) 124674-02
or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124681-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124674-02-1

Sun Java System Application Server Enterprise Edition 8.2 with
file-based patch 124677-01 or RHEL3.0/RHEL4.0 (Pkg_patch) 124674-02
or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124677-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124674-02-1

-- Windows --

Sun Java System Web Server 7.0 with Update 1 or later:
http://www.sun.com/download/products.xml?id=467713d6

Sun Java System Application Server Platform Edition 8.2 with
file-based patch 124682-01 or later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124682-01-1

Sun Java System Application Server Enterprise Edition 8.2 with
file-based patch 124678-01 or package-based patch 124684-02 or
later:
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124678-01-1
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-124684-02-1

-- HP-UX --

Sun Java System Web Server 7.0 with Update 1 or later:
http://www.sun.com/download/products.xml?id=467713d6

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Brad Hill, iSEC Partners.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102992-1

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------