Sun Microsystems, Inc. Information for VU#261869
Clientless SSL VPN products break web browser domain-based security models
- Vendor Information Help Date Notified: 19 Oct 2009
- Statement Date: 04 Dec 2009
- Date Updated: 08 Dec 2009
Sun Java System Portal Server Secure Remote Access can be configured to be not vulnerable to CVE-2009-2631. Secure Remote Access Gateway offers client-less SSL VPN functionality. It rewrites the URLs only for explicitly configured domains and subdomains. Hence it is not vulnerable to attacks launched from the Internet. Access to domains or hosts within the intranet can be further controlled by Allow/Deny access list to restrict access to only trusted internal sites.
Sun has published the following information:
CERT/CC has listed Sun Microsystems as vulnerable because certain configurations are subject to the issues described in the note.