PT-2009-3657 · Sun · Sun Java System Identity Manager

Published 2009-03-25 · Updated 2009-10-06 · CVE-2009-1078

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager (IdM) versions 7.0 through 8.0

Description The issue concerns the lack of proper privilege enforcement in Sun Java System Identity Manager (IdM) for certain actions, specifically deleting audit policies and modifying workflows. This allows remote authenticated users to potentially have an impact on the system.

Recommendations For versions 7.0 through 8.0, consider restricting access to the affected functionalities, such as deleting audit policies and modifying workflows, to authorized users only until a proper fix is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1078

Affected Products

Sun Java System Identity Manager

References · 8

• 🔥 http://securityfocus.com/bid/34191 · Exploit
• http://secunia.com/advisories/34380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1078 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Patch
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Vendor Advisory
• http://vupen.com/english/advisories/2009/0797 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Vendor Advisory
• http://securitytracker.com/id?1021881 · Note