PT-2007-4946 · Sun · Sun Java System Access Manager

Publicado 2007-07-11 · Atualizado 2017-07-29 · CVE-2007-3700

Positive Technologies (AI Summary)

CVSS v2.0

1.7

Baixa

Vetor base

AV:L/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager versions before 20070710

Description The issue allows local users to gain privileges by reading the debug log file. This occurs when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, causing cleartext login passwords to be logged.

Recommendations For Sun Java System Access Manager versions before 20070710, consider modifying the com.iplanet.services.debug.level property in AMConfig.properties to prevent logging of cleartext login passwords. As a temporary workaround, restrict access to the /var/opt/SUNWam/debug/amAuth log file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-3700

Produtos afetados

Sun Java System Access Manager

Referências · 9

• http://securitytracker.com/id?1018370 · Nota
• http://osvdb.org/37249 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101918-1 · Correção, Aviso do Fabricante
• http://securityfocus.com/bid/24859 · Nota
• http://vupen.com/english/advisories/2007/2496 · Nota
• http://secunia.com/advisories/26030 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200386-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35339 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3700 · Nota de Segurança