PT-2009-3656 · Sun · Sun Java System Identity Manager

Published 2009-03-25 · Updated 2009-10-06 · CVE-2009-1077

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager versions 7.0 through 8.0

Description The issue concerns the Change My Password feature in the admin interface, which fails to enforce the RequiresChallenge property setting. This allows remote authenticated users to change the passwords of other users without proper authorization, potentially leading to unauthorized access and changes to sensitive accounts.

Recommendations For Sun Java System Identity Manager versions 7.0 through 8.0, ensure that the RequiresChallenge property is properly enforced to prevent unauthorized password changes. Consider temporarily restricting access to the Change My Password feature in the admin interface until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1077

Affected Products

Sun Java System Identity Manager

References · 11

• 🔥 http://securityfocus.com/bid/34191 · Exploit
• http://secunia.com/advisories/34380 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Patch
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1077 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1 · Patch
• http://vupen.com/english/advisories/2009/0797 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Vendor Advisory
• http://securitytracker.com/id?1021881 · Note