PT-2008-6262 · Sun · Sun Java System Identity Manager

Published 2008-11-18 · Updated 2018-10-11 · CVE-2008-5116

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 6.0 through 6.0 SP4 Sun Java System Identity Manager version 7.0 Sun Java System Identity Manager version 7.1

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files on the IDM server's filesystem. This is achieved by using directory traversal sequences in the ext parameter of the idm/includes/helpServer.jsp file.

Recommendations For Sun Java System Identity Manager versions 6.0 through 6.0 SP4, consider restricting access to the helpServer.jsp file until a fix is available. For Sun Java System Identity Manager version 7.0, avoid using the ext parameter in the helpServer.jsp file until the issue is resolved. For Sun Java System Identity Manager version 7.1, restrict access to the vulnerable idm/includes/helpServer.jsp file to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5116

Affected Products

Sun Java System Identity Manager

References · 10

• 🔥 http://securityfocus.com/bid/32262 · Exploit
• http://vupen.com/english/advisories/2008/3128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5116 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243386-1 · Vendor Advisory
• http://secunia.com/advisories/32606 · Vendor Advisory
• http://osvdb.org/49767 · Note
• http://securityfocus.com/archive/1/498487/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46554 · Note
• http://securitytracker.com/id?1021170 · Note
• http://procheckup.com/Vulnerability_PR08-09.php · Note