PT-2008-6540 · Sun · Sun Ray Windows Connector+1

Published 2008-12-11 · Updated 2018-10-30 · CVE-2008-5423

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Sun Ray Server Software versions 3.x through 4.0 Sun Ray Windows Connector versions 1.1 through 2.0

Description The issue allows local users to discover the Sun Ray administration password, which can lead to obtaining admin access to the Data Store and Administration GUI. This is related to the utconfig component of the Server Software and the uttscadm component of the Windows Connector.

Recommendations For Sun Sun Ray Server Software versions 3.x through 4.0, consider restricting access to the utconfig component until a fix is available. For Sun Ray Windows Connector versions 1.1 through 2.0, consider disabling the uttscadm component as a temporary workaround to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-5423

Affected Products

Sun Ray Windows Connector

Sun Ray Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2008-5423 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-127556-03-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-04-1 · Patch
• http://secunia.com/advisories/33108 · Note
• http://secunia.com/advisories/33119 · Note
• http://securitytracker.com/id?1021379 · Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-240506-1 · Patch, Vendor Advisory
• http://vupen.com/english/advisories/2008/3407 · Note
• http://vupen.com/english/advisories/2008/3406 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47258 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-500.htm · Note
• http://securityfocus.com/bid/32772 · Note