PT-2009-3657 · Sun · Sun Java System Identity Manager

Publicado 2009-03-25 · Atualizado 2009-10-06 · CVE-2009-1078

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager (IdM) versions 7.0 through 8.0

Description The issue concerns the lack of proper privilege enforcement in Sun Java System Identity Manager (IdM) for certain actions, specifically deleting audit policies and modifying workflows. This allows remote authenticated users to potentially have an impact on the system.

Recommendations For versions 7.0 through 8.0, consider restricting access to the affected functionalities, such as deleting audit policies and modifying workflows, to authorized users only until a proper fix is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1078

Produtos afetados

Sun Java System Identity Manager

Referências · 8

• 🔥 http://securityfocus.com/bid/34191 · Exploit
• http://secunia.com/advisories/34380 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1078 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Correção
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Aviso do Fabricante
• http://securitytracker.com/id?1021881 · Nota
• http://vupen.com/english/advisories/2009/0797 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Aviso do Fabricante