This script is Copyright (C) 2016 Tenable Network Security, Inc.
The remote web server is affected by multiple vulnerabilities.
According to its self-reported version number, the Oracle GlassFish
Server running on the remote host is 3.1.2.x prior to 18.104.22.168. It is,
therefore, affected by multiple vulnerabilities :
- An information disclosure vulnerability exists in the
bundled version of libcurl in the smb_request_state()
function due to using values that are assumed valid
without properly checking boundaries. An
unauthenticated, remote attacker can exploit this, via a
malicious SMB server, to disclose arbitrary memory
- An unspecified flaw exists in the Web Container
subcomponent that allows an unauthenticated, remote
attacker to execute arbitrary code. (CVE-2016-3607)
See also :
Upgrade to Oracle GlassFish Server version 22.214.171.124 or later as
referenced in the July 2016 Oracle Critical Patch Update advisory.
Risk factor :
Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 7.4
Public Exploit Available : false