PT-2007-4946 · Sun · Sun Java System Access Manager

Published 2007-07-11 · Updated 2017-07-29 · CVE-2007-3700

Positive Technologies (AI Summary)

CVSS v2.0

1.7

Low

Base vector

AV:L/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager versions before 20070710

Description The issue allows local users to gain privileges by reading the debug log file. This occurs when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, causing cleartext login passwords to be logged.

Recommendations For Sun Java System Access Manager versions before 20070710, consider modifying the com.iplanet.services.debug.level property in AMConfig.properties to prevent logging of cleartext login passwords. As a temporary workaround, restrict access to the /var/opt/SUNWam/debug/amAuth log file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3700

Affected Products

Sun Java System Access Manager

References · 9

• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200386-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3700 · Security Note
• http://securitytracker.com/id?1018370 · Note
• http://osvdb.org/37249 · Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101918-1 · Patch, Vendor Advisory
• http://securityfocus.com/bid/24859 · Note
• http://vupen.com/english/advisories/2007/2496 · Note
• http://secunia.com/advisories/26030 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35339 · Note