Oracle iPlanet Web Proxy Server 4.0.x < 4.0.27 NSS ASN.1 Decoder RCE (April 2016 CPU)

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote web proxy server is affected by a remote code execution
vulnerability.

Description :

According to its self-reported version, the Oracle iPlanet Web Proxy
Server (formerly known as Sun Java System Web Proxy Server) installed
on the remote host is version 4.0.x prior to 4.0.27. It is, therefore,
affected by a heap buffer overflow condition in the ASN.1 decoder in
the Network Security Services (NSS) library. A remote attacker can
exploit this, via crafted OCTET STRING data, to cause a denial of
service or to execute arbitrary code.

See also :

http://www.nessus.org/u?855180af
http://www.nessus.org/u?f84b6b0a

Solution :

Upgrade to Oracle iPlanet Web Proxy Server version 4.0.27 or later as
referenced in the April 2016 Oracle Critical Patch Update advisory.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.5
(CVSS2#E:U/RL:ND/RC:C)
Public Exploit Available : false

Family: Windows

Nessus Plugin ID: 90627 ()

Bugtraq ID: 77416

CVE ID: CVE-2015-7182

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now