CVE-ID

CVE-2000-0812

• Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
The administration module in Sun Java web server allows remote attackers to execute arbitrary commands by uploading Java code to the module and invoke the com.sun.server.http.pagecompile.jsp92.JspServlet by requesting a URL that begins with a /servlet/ tag.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Date Entry Created
20000926 Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Interim (20010117)
Votes (Legacy)
ACCEPT(2) Baker, Dik
MODIFY(2) Frech, Levy
NOOP(3) Armstrong, Cole, Wall
REVIEWING(1) Christey
Comments (Legacy)
 Frech> XF:sunjava-webadmin-bbs(5135)
 Levy> BID 1600
 Frech> We also show this associated with CVE-2000-0629: The default
   configuration of the Sun Java web server 2.0 and earlier allows remote
   attackers to execute arbitrary commands by uploading Java code to the
   server via board.html, then directly calling the JSP compiler
   servlet. CVE web site concurs.
 Christey> I think that Casper Dik confirmed that CVE-2000-0629 is a
   configuration problem, and this one is a bug, so they are
   different problems.  I need to dig up that email, though...
 Dik> CVE-2000-0629 indeed is about sample code which shouldn't
   be run on prodution servers
   This one is an actual bug and patches have been produced
   for JWS 2.0 and 1.1.3

Proposed (Legacy)
20001018
This is an entry on the CVE list, which standardizes names for security problems.