Test ID:	1.3.6.1.4.1.25623.1.0.801532
Category:	Web Servers
Title:	Oracle Java System Web Server HTTP Response Splitting Vulnerability - Active Check
Summary:	Oracle Java System Web Server is prone to an HTTP response; splitting vulnerability.
Description:	Summary: Oracle Java System Web Server is prone to an HTTP response splitting vulnerability. Vulnerability Insight: The flaw is due to input validation error in the 'response.setHeader()' method which is not properly sanitising before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which will be included in a response sent to the user. Vulnerability Impact: Successful exploitation will allow remote attackers to conduct a cross-site scripting (XSS) and browser cache poisoning attacks. Affected Software/OS: Oracle Java System Web Server 6.x/7.x. Solution: Apply the referenced vendor update. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3514 Cert/CC Advisory: TA10-287A http://www.us-cert.gov/cas/techalerts/TA10-287A.html
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.