Sun Java System Web Server is prone to a format string vulnerability, which could be exploited to execute arbitrary code on the affected system.

No security patch or update is available as of February 11, 2010.
The customers are advised to visit vendor's site for any update.

Sun Java System Web Server is a well known web server designed for medium and large business applications. There exists a format string vulnerability in Sun Java System Web Server 7.0 update 6

The flaw exists due to format string error in the WebDAV functionality. An attacker may exploit this vulnerability by sending a specially-crafted HTTP request containing malicious format string specifiers in the encoding attribute of the XML declaration in a PROPFIND request. Successful exploitation allows remote code execution within the context of the affected application, resulting in webservd service crash.