PT-2009-3662 · Sun · Sun Java System Identity Manager

Publicado 2009-03-25 · Atualizado 2009-10-06 · CVE-2009-1083

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager (IdM) versions 7.0 through 8.0

Description The issue allows remote attackers to execute arbitrary commands due to the presence of "control characters" in user account passwords. This is achieved through vectors involving "resource adapters."

Recommendations For versions 7.0 through 8.0, consider restricting the use of "resource adapters" until a fix is available, and ensure that passwords do not contain "control characters" to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-1083

Produtos afetados

Sun Java System Identity Manager

Referências · 8

• http://secunia.com/advisories/34380 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-1083 · Nota de Segurança
• http://securityfocus.com/bid/34191 · Nota
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Aviso do Fabricante
• http://securitytracker.com/id?1021881 · Nota
• http://vupen.com/english/advisories/2009/0797 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Aviso do Fabricante