PT-2009-3662 · Sun · Sun Java System Identity Manager

Published 2009-03-25 · Updated 2009-10-06 · CVE-2009-1083

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager (IdM) versions 7.0 through 8.0

Description The issue allows remote attackers to execute arbitrary commands due to the presence of "control characters" in user account passwords. This is achieved through vectors involving "resource adapters."

Recommendations For versions 7.0 through 8.0, consider restricting the use of "resource adapters" until a fix is available, and ensure that passwords do not contain "control characters" to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-1083

Affected Products

Sun Java System Identity Manager

References · 8

• http://secunia.com/advisories/34380 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1083 · Security Note
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Vendor Advisory
• http://vupen.com/english/advisories/2009/0797 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Vendor Advisory
• http://securityfocus.com/bid/34191 · Note
• http://securitytracker.com/id?1021881 · Note