PT-2009-3653 · Sun · Sun Java System Identity Manager

Published 2009-03-25 · Updated 2009-10-06 · CVE-2009-1074

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 7.0 through 8.0

Description The issue allows remote attackers to obtain sensitive information by sniffing the network due to the lack of SSL usage in all expected circumstances. This is related to the use of "ssl termination devices" and the lack of support for relative URLs.

Recommendations For Sun Java System Identity Manager versions 7.0 through 8.0, ensure that SSL is properly configured and used in all expected circumstances to prevent sensitive information from being obtained by remote attackers. Consider implementing additional security measures to protect against network sniffing attacks.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-1074

Affected Products

Sun Java System Identity Manager

References · 8

• 🔥 http://securityfocus.com/bid/34191 · Exploit
• http://secunia.com/advisories/34380 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1074 · Security Note
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Patch
• http://vupen.com/english/advisories/2009/0797 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Vendor Advisory
• http://securitytracker.com/id?1021881 · Note