PT-2009-3653 · Sun · Sun Java System Identity Manager

Publicado 2009-03-25 · Atualizado 2009-10-06 · CVE-2009-1074

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 7.0 through 8.0

Description The issue allows remote attackers to obtain sensitive information by sniffing the network due to the lack of SSL usage in all expected circumstances. This is related to the use of "ssl termination devices" and the lack of support for relative URLs.

Recommendations For Sun Java System Identity Manager versions 7.0 through 8.0, ensure that SSL is properly configured and used in all expected circumstances to prevent sensitive information from being obtained by remote attackers. Consider implementing additional security measures to protect against network sniffing attacks.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-1074

Produtos afetados

Sun Java System Identity Manager

Referências · 8

• 🔥 http://securityfocus.com/bid/34191 · Exploit
• http://secunia.com/advisories/34380 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1074 · Nota de Segurança
• http://securitytracker.com/id?1021881 · Nota
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Correção
• http://vupen.com/english/advisories/2009/0797 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Aviso do Fabricante