PT-2009-2853 · Sun · Sun Java System Access Manager

Publicado 2009-01-16 · Atualizado 2017-08-08 · CVE-2009-0169

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager version 7.1

Description The issue allows remote authenticated sub-realm administrators to gain privileges. This can be demonstrated by creating the amadmin account in the sub-realm and then logging in as amadmin in the root realm.

Recommendations For Sun Java System Access Manager version 7.1, consider restricting access to sub-realm administration functions to prevent unauthorized privilege escalation. As a temporary workaround, limit the creation of administrative accounts within sub-realms to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0169

Produtos afetados

Sun Java System Access Manager

Referências · 7

• http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-02-1 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-249106-1 · Aviso do Fabricante
• http://securityfocus.com/bid/33266 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47944 · Nota
• http://securitytracker.com/id?1021604 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0169 · Nota de Segurança
• http://vupen.com/english/advisories/2009/0157 · Nota