PT-2009-3011 · Sun · Sun Java System Access Manager

Publicado 2009-01-29 · Atualizado 2017-08-08 · CVE-2009-0348

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager versions 6.3 through 7.1

Description The issue concerns the login module's behavior in responding differently to failed login attempts based on whether the user account exists. This allows remote attackers to enumerate valid usernames.

Recommendations For Sun Java System Access Manager versions 6.3 through 7.1, consider restricting access to the login module to minimize the risk of exploitation. As a temporary workaround, limit the number of failed login attempts to prevent username enumeration.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-0348

Produtos afetados

Sun Java System Access Manager

Referências · 8

• 🔥 https://exploit-db.com/exploits/32762 · Exploit
• http://securityfocus.com/bid/33489 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0348 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48283 · Nota
• http://vupen.com/english/advisories/2009/0269 · Nota
• http://secunia.com/advisories/33688 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-242026-1 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-15-1 · Correção