Sun Microsystems, Inc. Information for VU#261869
Clientless SSL VPN products break web browser domain-based security models
- Vendor Information Help Date Notified: 19 Oct 2009
- Statement Date: 04 Dec 2009
- Date Updated: 08 Dec 2009
Status
Affected
Vendor Statement
Sun Java System Portal Server Secure Remote Access can be configured to be not vulnerable to CVE-2009-2631. Secure Remote Access Gateway offers client-less SSL VPN functionality. It rewrites the URLs only for explicitly configured domains and subdomains. Hence it is not vulnerable to attacks launched from the Internet. Access to domains or hosts within the intranet can be further controlled by Allow/Deny access list to restrict access to only trusted internal sites.
Vendor Information
Sun has published the following information:
http://blogs.sun.com/security/entry/portal_server_is_not_vulnerable
Vendor References
http://blogs.sun.com/security/entry/portal_server_is_not_vulnerable
Addendum
CERT/CC has listed Sun Microsystems as vulnerable because certain configurations are subject to the issues described in the note.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
View Notes By
Report a Vulnerability
Please use the Vulnerability Reporting Form to report a vulnerability. Alternatively, you can send us email. Be sure to read our vulnerability disclosure policy.