PT-2009-3661 · Sun · Sun Java System Identity Manager

Published 2009-03-25 · Updated 2009-03-25 · CVE-2009-1082

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager (IdM) versions 7.0 through 8.0

Description The issue allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console. This can be demonstrated by gaining privileges for account creation and other administrative capabilities. The issue is related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.

Recommendations For Sun Java System Identity Manager (IdM) versions 7.0 through 8.0, consider restricting access to the Admin Console to minimize the risk of exploitation. As a temporary workaround, consider disabling the saveNoValidate action until a patch is available. Restrict the use of saveNoValidateAllowedFormsAndWorkflows IDs to prevent unauthorized access to administrative capabilities.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-1082

Affected Products

Sun Java System Identity Manager

References · 11

• http://secunia.com/advisories/34380 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Patch
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Vendor Advisory
• http://securityfocus.com/bid/34191 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1082 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1 · Patch
• http://vupen.com/english/advisories/2009/0797 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 · Note
• http://securitytracker.com/id?1021881 · Note