A new security vulnerability in the iPlanet Messaging Server/Sun ONE Messaging Server may allow a remote unprivileged user the ability to cause JavaScript to be evaluated in a local user's Internet Explorer (IE) browser and thus execute arbitrary code with the privileges of the user running IE.

Note: This issue only occurs when the client browser is Internet Explorer (IE).

This issue can occur in the following releases:

SPARC Platform

• iPlanet Messaging Server 5.2 (for Solaris 2.6 and Solaris 8) without patch 5.2hf2.07
• Sun ONE Messaging Server 6.2 (for Solaris 8, Solaris 9, Solaris 10) without patch 118207-37

x86 Platform

• Sun ONE Messaging Server 6.2 (for Solaris 9 and Solaris 10) without patch 118208-36

Linux Platform

• Sun ONE Messaging Server 6.2 (for RHEL 2.1 or 3.0) without patch 118209-36

Notes:

1. iPlanet Messaging Server 5.2 is not supported on Solaris 7.
2. Sun ONE Messaging Server 6.2 is not supported on Solaris 7 or Solaris 8 on the x86 platform.

There are no reliable symptoms that would indicate the described issue has been exploited.

There is no workaround. Please see the Resolution section below.

This issue is addressed in the following releases:

SPARC Platform

• iPlanet Messaging Server 5.2 (for Solaris 2.6 and Solaris 8) with patch 5.2hf2.07 or later
• Sun ONE Messaging Server 6.2 (for Solaris 8, Solaris 9, Solaris 10) with patch 118207-37 or later

x86 Platform

• Sun ONE Messaging Server 6.2 (for Solaris 9 and Solaris 10) with patch 118208-36 or later

Linux Platform

• Sun ONE Messaging Server 6.2 (for RHEL 2.1 or 3.0) with patch 118209-36 or later

Note: iPlanet Messaging Server 5.2 patch 5.2hf2.02 is available through normal support channels.

25-Aug-2005:

• Update Contributing Factors and Resolution sections

12-Sep-2005:

• Updated Contributing Factors and Resolution sections

29-Sep-2005:

• Update Contributing Factors and Resolution sections, re-release as Resolved

This solution has no attachment