PT-2008-6262 · Sun · Sun Java System Identity Manager

Publicado 2008-11-18 · Atualizado 2018-10-11 · CVE-2008-5116

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 through 6.0 SP4 Sun Java System Identity Manager version 7.0 Sun Java System Identity Manager version 7.1

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files on the IDM server's filesystem. This is achieved by using directory traversal sequences in the ext parameter of the idm/includes/helpServer.jsp file.

Recommendations For Sun Java System Identity Manager versions 6.0 through 6.0 SP4, consider restricting access to the helpServer.jsp file until a fix is available. For Sun Java System Identity Manager version 7.0, avoid using the ext parameter in the helpServer.jsp file until the issue is resolved. For Sun Java System Identity Manager version 7.1, restrict access to the vulnerable idm/includes/helpServer.jsp file to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5116

Produtos afetados

Sun Java System Identity Manager

Referências · 10

• 🔥 http://securityfocus.com/bid/32262 · Exploit
• http://osvdb.org/49767 · Nota
• http://securityfocus.com/archive/1/498487/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46554 · Nota
• http://securitytracker.com/id?1021170 · Nota
• http://vupen.com/english/advisories/2008/3128 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5116 · Nota de Segurança
• http://procheckup.com/Vulnerability_PR08-09.php · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1 · Aviso do Fabricante
• http://secunia.com/advisories/32606 · Aviso do Fabricante