Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in HTTP requests to unspecified ASP applications.

The remote host is running Sun Java System Active Server Pages (ASP), or an older variant such as Sun ONE ASP or Chili!Soft ASP. 

The web server component of the installed version of Active Server Pages on the remote host is affected by several vulnerabilities :

  - Several of the administration server's ASP applications     fail to filter or escape user input before using it to     generate commands before executing them in a shell.
    While access to these applications nominally requires     authentication, there are reportedly several methods     of bypassing authentication (CVE-2008-2405).

  - An attacker can bypass administration server     authentication by connection to the application     server directly and making requests. This issue does     not affect ASP Server on a Windows platform     (CVE-2008-2406).

The remote host is running Sun Java System Active Server Pages (ASP), or an older variant such as Sun ONE ASP or Chili!Soft ASP. 

The web server component of the installed version of Active Server Pages on the remote host is affected by several vulnerabilities :

  - A flaw in an include file used by several of the     administration server's ASP applications allows an     attacker to write arbitrary data to a file specified     by an attacker on the affected host. This issue does     not affect ASP Server on a Windows platform     (CVE-2008-2401).

  - Password and configuration data are stored in the     administration server's web root and can be retrieved     without credentials. This issue does not affect ASP     Server on a Windows platform (CVE-2008-2402).

  - Multiple directory traversal vulnerabilities exist in     several of the administration server's ASP     applications and can be abused to read or even delete     arbitrary files on the affected host. This issue does     not affect ASP Server on a Windows platform     (CVE-2008-2403).

  - A stack-based buffer overflow allows code execution in     the context of the ASP server (by default root) and can     be exploited without authentication (CVE-2008-2404).

  - Several of the administration server's ASP applications     fail to filter or escape user input before using it to     generate commands before executing them in a shell.
    While access to these applications nominally requires     authentication, there are reportedly several methods     of bypassing authentication (CVE-2008-2405).

The remote host is running Sun Java System Active Server Pages (ASP), or an older variant such as Sun ONE ASP or Chili!Soft ASP.  The web server component of the installed version of Active Server Pages on the remote host is affected by several vulnerabilities :

  - A flaw in an include file used by several of the administration server's ASP applications allows an attacker to write arbitrary data to a file specified by an attacker on the affected host. This issue does not affect ASP Server on a Windows platform  (CVE-2008-2401).
  - Password and configuration data are stored in the administration server's web root and can be retrieved without credentials. This issue does not affect ASP Server on a Windows platform (CVE-2008-2402).
  - Multiple directory traversal vulnerabilities exist in several of the administration server's ASP applications can be abused to read or even delete arbitrary files on the affected host. This issue does not affect ASP Server on a Windows platform (CVE-2008-2403).
  - A stack buffer overflow allows code execution in the context of the ASP server (by default root) and can be exploited without authentication (CVE-2008-2404).
  - Several of the administration server's ASP applications fail to filter or escape user input before using it togenerate commands before executing them in a shell.  While access to these applications nominally requires authentication, there are reportedly several methods of bypassing authentication (CVE-2008-2405).

ID	Name	Product	Family	Type	Severity
33440	Sun Java System ASP Server < 4.0.3 Multiple Vulnerabilities	Nessus	Web Servers	Remote	high
33439	Sun Java System ASP < 4.0.3 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical
4533	Sun Java System ASP < 4.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		critical

Detections

Analytics

CVE-2008-2405

critical

Tenable Plugins

high

critical

critical