PT-2009-2853 · Sun · Sun Java System Access Manager

Published 2009-01-16 · Updated 2017-08-08 · CVE-2009-0169

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager version 7.1

Description The issue allows remote authenticated sub-realm administrators to gain privileges. This can be demonstrated by creating the amadmin account in the sub-realm and then logging in as amadmin in the root realm.

Recommendations For Sun Java System Access Manager version 7.1, consider restricting access to sub-realm administration functions to prevent unauthorized privilege escalation. As a temporary workaround, limit the creation of administrative accounts within sub-realms to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0169

Affected Products

Sun Java System Access Manager

References · 7

• http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-02-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-249106-1 · Vendor Advisory
• http://securityfocus.com/bid/33266 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-0169 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47944 · Note
• http://securitytracker.com/id?1021604 · Note
• http://vupen.com/english/advisories/2009/0157 · Note