PT-2009-3663 · Sun · Sun Java System Identity Manager

Published 2009-03-25 · Updated 2017-08-17 · CVE-2009-1084

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Identity Manager (IdM) versions 7.0 through 8.0

Description The issue is related to improper access restriction to the System Configuration object. This could allow remote authenticated administrators and possibly remote attackers to modify the object, potentially having an unspecified impact.

Recommendations For versions 7.0 through 8.0, restrict access to the System Configuration object to prevent unauthorized modifications. As a temporary workaround, consider limiting the privileges of remote authenticated administrators to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1084

Affected Products

Sun Java System Identity Manager

References · 10

• http://secunia.com/advisories/34380 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1 · Patch
• http://blogs.sun.com/security/entry/sun_alert_253267_sun_java · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1084 · Security Note
• http://vupen.com/english/advisories/2009/0797 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1 · Vendor Advisory
• http://securityfocus.com/bid/34191 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49607 · Note
• http://securitytracker.com/id?1021881 · Note