CVE-2003-1578

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning with a "format=" substring, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/313867Exploit
http://www.securityfocus.com/bid/7012Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/56633
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201453-1Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/313867Exploit
http://www.securityfocus.com/bid/7012Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/56633

Timeline

Published: Feb 5, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-15794.3Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not i CVE-2003-15804.3The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether CVE-2003-15812.6The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into CVE-2003-15822.6Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject CVE-2003-15834.3Cross-site scripting (XSS) vulnerability in WebTrends allows remote attackers to inject arbitrary web script or HTML via a crafted client do CVE-2003-15844.3Cross-site scripting (XSS) vulnerability in SurfStats allows remote attackers to inject arbitrary web script or HTML via a crafted client do CVE-2003-15854.3Cross-site scripting (XSS) vulnerability in WebLogExpert allows remote attackers to inject arbitrary web script or HTML via a crafted client CVE-2003-15864.3Cross-site scripting (XSS) vulnerability in WebExpert allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agen CVE-2003-15875.0Cross-site scripting (XSS) vulnerability in LoganPro allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agent CVE-2003-15881.9Sun Cluster 2.2, when HA-Oracle or HA-Sybase DBMS services are used, stores database credentials in cleartext in a cluster configuration fil CVE-2003-15895.0Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 4.1 before SP13 and 6.0 before SP6 on Windows allows attackers to cause a deni CVE-2003-15905.0Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 6.0 SP3 through SP5 on Windows allows remote attackers to cause a denial of se