CVE-2003-1577 (GCVE-0-2003-1577)
Vulnerability from cvelistv5
Published
2010-02-05 22:13
Modified
2024-08-08 02:35
Severity ?
CWE
  • n/a
Summary
Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an "Inverse Lookup Log Corruption (ILLC)" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:35:16.449Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "201453",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1"
          },
          {
            "name": "sunone-iplanetlog-xss(56632)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56632"
          },
          {
            "name": "20030304 Log corruption on multiple webservers, log analyzers,...",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/313867"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-03-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an \"Inverse Lookup Log Corruption (ILLC)\" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "201453",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1"
        },
        {
          "name": "sunone-iplanetlog-xss(56632)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56632"
        },
        {
          "name": "20030304 Log corruption on multiple webservers, log analyzers,...",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/313867"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-1577",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an \"Inverse Lookup Log Corruption (ILLC)\" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "201453",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1"
            },
            {
              "name": "sunone-iplanetlog-xss(56632)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56632"
            },
            {
              "name": "20030304 Log corruption on multiple webservers, log analyzers,...",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/313867"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1577",
    "datePublished": "2010-02-05T22:13:00",
    "dateReserved": "2010-02-05T00:00:00",
    "dateUpdated": "2024-08-08T02:35:16.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2003-1577\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2010-02-05T22:30:01.563\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an \\\"Inverse Lookup Log Corruption (ILLC)\\\" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.\"},{\"lang\":\"es\",\"value\":\"Sun ONE (tambien conocido como iPlanet) Web Server v4.1 hasta SP12 y v6.0 hasta SP5, cuando la resoluci\u00f3n DNS est\u00e1 activada para direcciones IP de clientes, permite a atacantes remotos inyectar t\u00e9xto de su elecci\u00f3n dentro de ficheros de log, y provocar un ataque de secuencias de comandos en sitios cruzados (XSS)involucrando al analizador iPlanet Log, a trav\u00e9s de una petici\u00f3n HTTP en ocnjunci\u00f3n con una respuesta DNS manipulada, relacionado con el tema \\\"Inverse Lookup Log Corruption (ILLC)\\\", una vulnerabilidad difrente que CVE-2002-1315 y CVE-2002-1316.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:N/C:N/I:P/A:N\",\"baseScore\":2.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":4.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:*:sp12:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.1\",\"matchCriteriaId\":\"B96D0FA5-9288-4B6D-8D81-C892FE8CCBE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33621D67-8191-42EE-8859-8B5FC30F935A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C6F8563-701E-4E54-A0C9-67E9DF74D60D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp10:*:*:*:*:*:*\",\"matchCriteriaId\":\"4022E5C6-5651-45DD-AF73-89CF38E71D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp11:*:*:*:*:*:*\",\"matchCriteriaId\":\"EEF4CFCE-DEEC-4652-A96F-0C7B5A88175A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE01BAC9-DC57-4BC8-9BFB-9C7C94A516A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CEA91AD-443D-4856-AC7A-3DDE0791134D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp4:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C1D4DC-252A-4602-A916-32E51CCA75B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp5:*:*:*:*:*:*\",\"matchCriteriaId\":\"526D2FAD-4241-412C-8863-B273D3733153\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8A796CB-D675-49FC-98BA-4D527211C70D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8693959B-7D5D-414B-8660-2A693AF24541\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp8:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BDC4A06-33A1-4619-B870-7F2AF1D332F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:4.1:sp9:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A445032-AD7B-4971-B175-DF3183A4A12C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:*:sp5:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.0\",\"matchCriteriaId\":\"404F6586-4E74-40CE-B579-945D21FC4AB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD6EF410-9D8F-4C94-8636-93D455E0C072\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:6.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CA92E60-8D25-4BA0-8C71-7A271439DEDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:6.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A968709C-2B0B-423B-8A75-61D301DE7398\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:6.0:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"38698A3B-9597-4BC9-B112-BB908C3DE86B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sun:one_web_server:6.0:sp4:*:*:*:*:*:*\",\"matchCriteriaId\":\"78587B6D-2A95-4714-9632-4F75CD552E7A\"}]}]}],\"references\":[{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/313867\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/56632\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/313867\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/56632\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.