Description
The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
References
- 20040118 Proof-Of-Concept Denial-Of-Service Pointbase 4.6 Java SQL-DB mailing-list
- 10460 third-party-advisory
- 20040118 Proof-Of-Concept Denial-Of-Service Pointbase 4.6 Java SQL-DB mailing-list
- j2ee-pointbase-sql-injection(14008) vdb-entry
- 1008491 vdb-entry
- 9230 vdb-entry
- pointbase-command-execution(14883) vdb-entry
- pointbase-information-disclosure(14882) vdb-entry
- 20031216 J2EE 1.4 reference implementation: database component allows remote code execution mailing-list
- pointbase-insecure-permissions-dos(14881) vdb-entry