PT-2009-3656 · Sun · Sun Java System Identity Manager

Publicado 2009-03-25 · Atualizado 2009-10-06 · CVE-2009-1077

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 7.0 through 8.0

Description The issue concerns the Change My Password feature in the admin interface, which fails to enforce the RequiresChallenge property setting. This allows remote authenticated users to change the passwords of other users without proper authorization, potentially leading to unauthorized access and changes to sensitive accounts.

Recommendations For Sun Java System Identity Manager versions 7.0 through 8.0, ensure that the RequiresChallenge property is properly enforced to prevent unauthorized password changes. Consider temporarily restricting access to the Change My Password feature in the admin interface until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1077

Produtos afetados

Sun Java System Identity Manager

Referências · 11

• 🔥 http://securityfocus.com/bid/34191 · Exploit
• http://secunia.com/advisories/34380 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Correção
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Aviso do Fabricante
• http://securitytracker.com/id?1021881 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-1077 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1 · Correção
• http://vupen.com/english/advisories/2009/0797 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Aviso do Fabricante