Sun Microsystems, Inc. Information for VU#261869

Clientless SSL VPN products break web browser domain-based security models

Status

Affected

Vendor Statement

Sun Java System Portal Server Secure Remote Access can be configured to be not vulnerable to CVE-2009-2631. Secure Remote Access Gateway offers client-less SSL VPN functionality. It rewrites the URLs only for explicitly configured domains and subdomains. Hence it is not vulnerable to attacks launched from the Internet. Access to domains or hosts within the intranet can be further controlled by Allow/Deny access list to restrict access to only trusted internal sites.

Vendor Information

Sun has published the following information:

http://blogs.sun.com/security/entry/portal_server_is_not_vulnerable

Vendor References

http://blogs.sun.com/security/entry/portal_server_is_not_vulnerable

Addendum

CERT/CC has listed Sun Microsystems as vulnerable because certain configurations are subject to the issues described in the note.

If you have feedback, comments, or additional information about this vulnerability, please send us email.