PT-2009-2854 · Sun · Sun Java System Access Manager

Published 2009-01-16 · Updated 2018-10-30 · CVE-2009-0170

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Access Manager versions 6.3 2005Q1 through 7.1

Description The issue allows remote authenticated users with console privileges to discover passwords and obtain access to other resources by visiting the Configuration Items component in the console.

Recommendations For versions 6.3 2005Q1 through 7.1, restrict access to the Configuration Items component in the console to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

CWE-255

Related Identifiers

CVE-2009-0170

Affected Products

Sun Java System Access Manager

References · 7

• http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-02-1 · Vendor Advisory
• http://securityfocus.com/bid/33265 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-242166-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0170 · Security Note
• http://vupen.com/english/advisories/2009/0156 · Note
• http://securitytracker.com/id?1021605 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47942 · Note