A security vulnerability in Sun Java System or iPlanet Messaging Servers may allow remote unprivileged users to craft specific messages which contain Javascript to be executed in the end user's browser.

Sun acknowledges, with thanks, Seth Hall of Ohio State University, for bringing this issue to our attention.

This issue can occur in the following releases:

SPARC Platform

• iPlanet Messaging Server 5.2 (for Solaris 8 and 9) without patch 5.2hf2.13
• Sun Java System Messaging Server 6.0, 6.1, and 6.2 (for Solaris 8, 9, and 10) without patch 118207-56

x86 Platform

• Sun Java System Messaging Server 6.0, 6.1, and 6.2 (for Solaris 9 and 10) without patch 118208-56

Linux Platform

• Sun Java System Messaging Server 6.0, 6.1, and 6.2 (for RHEL 2.1 and 3.0) without patch 118209-56

To determine if Sun Java System Messaging Server is installed on a system, the following command can be run:

    % pkginfo SUNWmsgco
    application SUNWmsgco   Sun Java System Messaging Server Core Libraries

To determine the version of iPlanet Messaging Server on a system, the following command can be run:

    $ cat /etc/msgregistry.inf

A list of instances and installs will displayed (if any) if this file exists.

To determine the version of Sun Java Messaging Server on a system, the following command can be run:

    $ /opt/SUNWmsgsr/sbin/imsimta version

There are no predictable symptoms that would indicate the described vulnerability has been exploited.

There is no workaround for this issue. Please see the Resolution section below.

This issue is addressed in the following releases:

SPARC Platform

• iPlanet Messaging Server 5.2 (for Solaris 8 and 9) with patch 5.2hf2.13 or later
• Sun Java System Messaging Server 6.0, 6.1, and 6.2 (for Solaris 8, 9, and 10) with patch 118207-56 or later

x86 Platform

• Sun Java System Messaging Server 6.0, 6.1, and 6.2 (for Solaris 9 and 10) with patch 118208-56 or later

Linux Platform

• Sun Java System Messaging Server 6.0, 6.1, and 6.2 (for RHEL 2.1 and 3.0) with patch 118209-56 or later

Note: iPlanet Messaging Server 5.2 patch 5.2hf2.13 is available to all customers through normal support channels regardless of support contract.

This solution has no attachment